1

Is there any relation between auditd and SELinux? Or can we use auditd even if SELinux is disabled?

3

SELinux uses auditd for logging purposes, but auditd is independent from it. You can use auditd without SELinux present.

  • This is correct, but perhaps you could expand on how it works (e.g. how SELinux uses the audit subsystem, which auditd interfaces with). – forest Sep 6 '18 at 3:13

Not the answer you're looking for? Browse other questions tagged or ask your own question.