Quoting Daniel J Walsh <dwalsh(a)redhat.com>:
You can use the Audit Framework for watching certain files with or
without SELinux.
Have you looked at auditd and auditctl.
Hm, looks interesting. A bit missing in documentation on RHEL4, however I
fetched sources from rawhide (that have some documentation). Is Audit
Framework part of SELinux, used by SELinux, or something totally unrelated?
----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.