Here is an interesting one

[Russell Coker]

On Tuesday 08 March 2005 09:27, Richard Irving <rirving at antient.org> wrote:
>   "dontaudit snmpd_t unconfined_t:process signull;"

Which process is it trying to send signull to?  You will have to either enable 
auditing or use strace or gdb to trace it to discover what is going on.

The access in question may be undesired or it may be something that is 
actually required, without knowing more about your situation it's impossible 
to determine.  It would be best if you could track this down, I don't 
recommend the dontaudit rule without more investigation.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page