On Mon, 2008-07-21 at 08:39 -0500, LC Bruzenak wrote: ... > > Thank you for the reply, however there was no config change after I > installed this file. > The action is happening automatically, since it occurred at 4AM. > I suspect that the prelink cron job is doing this.
That is definitely the problem - prelink cron job moves file, which erases the CAP. The audit record was adequate in pointing me to the problem. LCB. -- LC (Lenny) Bruzenak [EMAIL PROTECTED] -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
