Re: Selinux Audit "Unmatched Entries"?

[Daniel J Walsh]

On 07/30/2009 10:08 AM, Frank Murphy wrote:
>  On 30/07/09 15:05, Daniel J Walsh wrote:
> > On 07/30/2009 04:49 AM, Frank Murphy wrote:
> >> Waht does all this mean from logwatch,
> >> What are in  plain speak unmatched entries?
> >>
> >>
>  --SNIP--
> >>
> > These are audit messages, not SELinux AVC messages or any kind of
> > SELinux message.
>  
>  They can be safely ignored then
>  
>  -- 
>  fedora-selinux-list mailing list
>  fedora-selinux-list(a)redhat.com
>  https://www.redhat.com/mailman/listinfo/fedora-selinux-list 
Yes these messages are
the audit system telling you that readahead added an removed some rules to the audit
system at boot time.

I believe readahead now adds a rule to watch for all file opens at boot until it is
finished, it then records the file opens and saves them, to reconfigure itself for the
next boot, to be more efficient.  Your mileage may vary.

So I think whatever is searching for these rules should ignore them as expected.