dbusd avc audit messages are generated by libselinux using a callback
function provided by dbusd, and dbusd likely is just using syslog()
rather than communicating with the audit daemon.
I traced through the code and created a patch for dbus to use libaudit. It now
works fine. But, I noticed the kernel generated messages have more information in
them. I guess that's what the audit hook (avc_func_audit) was for.
-Steve Grubb
__________________________________
Do you Yahoo!?
Yahoo! Mail - Helps protect you from nasty viruses.
http://promotions.yahoo.com/new_mail