[Bulk] Re: selinux and /etc/passwd

[Stephen Smalley]

On Tue, 2004-11-09 at 23:49, Sergiu Giurgiu wrote:
> right now it doesn't show anything. I have disabled selinux on the 
> system, probably thats why.

Hmmm...shouldn't matter, as audit2allow -v -i /var/log/messages is just
looking for audit messages in /var/log/messages.

> should i look for something in /var/log/messages ?

Yes, that is what the above command should have done, regardless of
whether you are running SELinux presently or not.  You can certainly
look directly at /var/log/messages for other SELinux-related output, but
if you aren't seeing any audit messages, then I'm not sure what is
happening. 

-- 
Stephen Smalley <sds at epoch.ncsc.mil>
National Security Agency