You could change all occurances of allow to auditallow. This will still let the action go through, but log it.
You can use sed to make this change. On Oct 8, 2013 9:32 PM, "Ruowen Wang" <[email protected]> wrote: > Hi SEAndroid, > > I am a new comer. I am playing with the audit.log and audit2allow in > SEAndroid. One thing I am wondering is that I cannot find "granted" > messages but only "denied" message in audit.log, which is different from > the desktop version of the audit daemon. Is it possible to configure the > auditd to log granted messages? > > Thanks, > > Best Regards! > Ruowen > >
