On Mon, Jun 6, 2022 at 7:10 PM Lenny Bruzenak <le...@magitekltd.com> wrote: > I've been told that it is not a potential security problem, and not subject > to change in the (current) kernel.
I'm that little birdy that Lenny was talking to off-list so I figured I would add a quick comment here :) As a reminder, elevated privilege is needed to both add/remove/modify audit rules as well as the loaded SELinux policy (affecting the validity of the relevant security labels). Also, as Lenny already mentioned, if an invalid security label is used, the kernel will notify the admin via the kernel log. -- paul-moore.com -- Linux-audit mailing list Linux-audit@redhat.com https://listman.redhat.com/mailman/listinfo/linux-audit
