Hello, On Thursday, January 18, 2024 7:46:13 AM EST Max Nebiun wrote: Yes. Bash is in the user session which is likely unconfined_t. What you want to do is one of 2 things. 1). Create you own selinux policy. Start by making a transition for your program from auditd_t to your own type. You may need to change the label of the plugin to an exec_t type which you will then use to create policy placing it in it's final domain. Then run in permissive mode and restart auditd. Exercise the plugin so that you get a lot of AVCs. Then use auseach --start recent --exe=/sbin/plugin -m AVC --raw | audit2allow To create the rest of the policy. You can probably find examples similar to this on the internet...or maybe give chatGPT a shot at it. 2) Enable the audisp_af_unix plugin and rework your plugin to read from it. Your plugin should run as a service which would place it in initrc_t since it has no policy. Initrc_t is a permissive domain and you shouldn't have problems - at least from selinux. The better solution is #1 above. -Steve