On Mon, 2008-07-21 at 13:16 +0800, zhangxiliang wrote: > > > > So the file is getting moved to a temp file and then back (is the > > prelink doing this?) with the result being that the CAP is erased. > > > > Not certain what is doing this in my system. > > Any clues or instructions on how to narrow the search? > > Could you supply the audit message which type is "AUDIT_CONFIG_CHANGE" in > your result?
[EMAIL PROTECTED] ~]# ausearch -i -k AUDIT_CONFIG_CHANGE <no matches> Thank you for the reply, however there was no config change after I installed this file. The action is happening automatically, since it occurred at 4AM. I suspect that the prelink cron job is doing this. LCB. -- LC (Lenny) Bruzenak [EMAIL PROTECTED] -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
