Hello, On Tuesday, January 8, 2019 12:09:57 AM EST Simon Außerlechner wrote: There isn't a capability to have auditd or the kernel to filter based on the parent program's name. We only have the numeric representation. If your program is supposed to be launched only by a specific known program or programs, this is possibly something selinux could help with. This way when someone tries it at the command line you get an AVC. This would also assume that you do not let people log in as unconfined_t. Another possibility is that perhaps you can assign a supplemental group to your programs which launch your other program. Have it check that its inherited the supplemental group and exit if not. Or restrict execution by file permissions to that group. It should then be possible to look for execution of that returning EPERM. -Steve