The result:
[1754543.251421] type=1505 audit(1274733521.551:129): operation="profile_replace" pid=25980 name="/usr/bin/freshclam" [1765351.326452] type=1502 audit(1274744329.626:130): operation="exec" pid=24546 parent=24545 profile="/usr/bin/freshclam" requested_mask="::x" denied_mask="::x" fsuid=107 ouid=0 name="/bin/dash" name2="/usr/bin/freshclam//null-12" [1765351.326826] type=1502 audit(1274744329.626:131): operation="open" pid=24546 parent=24545 profile="/usr/bin/freshclam//null-12" requested_mask="::r" denied_mask="::r" fsuid=107 ouid=0 name="/etc/ld.so.cache" [1765351.326884] type=1502 audit(1274744329.626:132): operation="open" pid=24546 parent=24545 profile="/usr/bin/freshclam//null-12" requested_mask="::r" denied_mask="::r" fsuid=107 ouid=0 name="/lib/tls/i686/cmov/libc-2.11.1.so" [1765351.326915] type=1502 audit(1274744329.626:133): operation="file_mmap" pid=24546 parent=24545 profile="/usr/bin/freshclam//null-12" requested_mask="::mr" denied_mask="::mr" fsuid=107 ouid=0 name="/lib/tls/i686/cmov/libc-2.11.1.so" [1765351.361355] type=1502 audit(1274744329.662:134): operation="exec" pid=24547 parent=24546 profile="/usr/bin/freshclam//null-12" requested_mask="::x" denied_mask="::x" fsuid=107 ouid=0 name="/bin/run-parts" name2="/usr/bin/freshclam//null-12//null-13" [1765351.366319] type=1502 audit(1274744329.666:135): operation="open" pid=24547 parent=24546 profile="/usr/bin/freshclam//null-12//null-13" requested_mask="::r" denied_mask="::r" fsuid=107 ouid=0 name="/etc/ld.so.cache" [1765351.366379] type=1502 audit(1274744329.666:136): operation="open" pid=24547 parent=24546 profile="/usr/bin/freshclam//null-12//null-13" requested_mask="::r" denied_mask="::r" fsuid=107 ouid=0 name="/lib/tls/i686/cmov/libc-2.11.1.so" [1765351.366410] type=1502 audit(1274744329.666:137): operation="file_mmap" pid=24547 parent=24546 profile="/usr/bin/freshclam//null-12//null-13" requested_mask="::mr" denied_mask="::mr" fsuid=107 ouid=0 name="/lib/tls/i686/cmov/libc-2.11.1.so" [1765351.379702] type=1502 audit(1274744329.678:138): operation="open" pid=24547 parent=24546 profile="/usr/bin/freshclam//null-12//null-13" requested_mask="::r" denied_mask="::r" fsuid=107 ouid=0 name="/etc/clamav/onupdateexecute.d/" [1765385.616534] __ratelimit: 135 callbacks suppressed [1765385.616539] type=1502 audit(1274744363.918:184): operation="exec" pid=24887 parent=24885 profile="/usr/bin/freshclam//null-12//null-13//null-14" requested_mask="::x" denied_mask="::x" fsuid=107 ouid=0 name="/bin/hostname" name2="/usr/bin/freshclam//null-12//null-13//null-14//null-16" [1765385.619011] type=1502 audit(1274744363.918:185): operation="open" pid=24887 parent=24885 profile="/usr/bin/freshclam//null-12//null-13//null-14//null-16" requested_mask="::r" denied_mask="::r" fsuid=107 ouid=0 name="/etc/ld.so.cache" [1765385.619065] type=1502 audit(1274744363.918:186): operation="open" pid=24887 parent=24885 profile="/usr/bin/freshclam//null-12//null-13//null-14//null-16" requested_mask="::r" denied_mask="::r" fsuid=107 ouid=0 name="/lib/tls/i686/cmov/libnsl-2.11.1.so" [1765385.619100] type=1502 audit(1274744363.918:187): operation="file_mmap" pid=24887 parent=24885 profile="/usr/bin/freshclam//null-12//null-13//null-14//null-16" requested_mask="::mr" denied_mask="::mr" fsuid=107 ouid=0 name="/lib/tls/i686/cmov/libnsl-2.11.1.so" [1765385.619180] type=1502 audit(1274744363.918:188): operation="open" pid=24887 parent=24885 profile="/usr/bin/freshclam//null-12//null-13//null-14//null-16" requested_mask="::r" denied_mask="::r" fsuid=107 ouid=0 name="/lib/tls/i686/cmov/libc-2.11.1.so" [1765385.619206] type=1502 audit(1274744363.918:189): operation="file_mmap" pid=24887 parent=24885 profile="/usr/bin/freshclam//null-12//null-13//null-14//null-16" requested_mask="::mr" denied_mask="::mr" fsuid=107 ouid=0 name="/lib/tls/i686/cmov/libc-2.11.1.so" [1765385.630737] type=1502 audit(1274744363.930:190): operation="exec" pid=24886 parent=24548 profile="/usr/bin/freshclam//null-12//null-13//null-14" requested_mask="::x" denied_mask="::x" fsuid=107 ouid=0 name="/usr/bin/mail" name2="/usr/bin/freshclam//null-12//null-13//null-14//null-17" [1765385.639718] type=1502 audit(1274744363.938:191): operation="open" pid=24886 parent=24548 profile="/usr/bin/freshclam//null-12//null-13//null-14//null-17" requested_mask="::r" denied_mask="::r" fsuid=107 ouid=0 name="/etc/ld.so.cache" [1765385.646332] type=1502 audit(1274744363.946:192): operation="open" pid=24886 parent=24548 profile="/usr/bin/freshclam//null-12//null-13//null-14//null-17" requested_mask="::r" denied_mask="::r" fsuid=107 ouid=0 name="/usr/lib/libmu_cfg.so.0.0.0" [1765385.649362] type=1502 audit(1274744363.950:193): operation="file_mmap" pid=24886 parent=24548 profile="/usr/bin/freshclam//null-12//null-13//null-14//null-17" requested_mask="::mr" denied_mask="::mr" fsuid=107 ouid=0 name="/usr/lib/libmu_cfg.so.0.0.0"
The result:
[1754543.251421] type=1505 audit(127473352 1.551:129) : operation= "profile_ replace" pid=25980 name="/ usr/bin/ freshclam" 9.626:130) : operation="exec" pid=24546 parent=24545 profile= "/usr/bin/ freshclam" requested_ mask=": :x" denied_mask="::x" fsuid=107 ouid=0 name="/bin/dash" name2=" /usr/bin/ freshclam/ /null-12" 9.626:131) : operation="open" pid=24546 parent=24545 profile= "/usr/bin/ freshclam/ /null-12" requested_ mask=": :r" denied_mask="::r" fsuid=107 ouid=0 name="/ etc/ld. so.cache" 9.626:132) : operation="open" pid=24546 parent=24545 profile= "/usr/bin/ freshclam/ /null-12" requested_ mask=": :r" denied_mask="::r" fsuid=107 ouid=0 name="/ lib/tls/ i686/cmov/ libc-2. 11.1.so" 9.626:133) : operation= "file_mmap" pid=24546 parent=24545 profile= "/usr/bin/ freshclam/ /null-12" requested_ mask=": :mr" denied_mask="::mr" fsuid=107 ouid=0 name="/ lib/tls/ i686/cmov/ libc-2. 11.1.so" 9.662:134) : operation="exec" pid=24547 parent=24546 profile= "/usr/bin/ freshclam/ /null-12" requested_ mask=": :x" denied_mask="::x" fsuid=107 ouid=0 name="/ bin/run- parts" name2=" /usr/bin/ freshclam/ /null-12/ /null-13" 9.666:135) : operation="open" pid=24547 parent=24546 profile= "/usr/bin/ freshclam/ /null-12/ /null-13" requested_ mask=": :r" denied_mask="::r" fsuid=107 ouid=0 name="/ etc/ld. so.cache" 9.666:136) : operation="open" pid=24547 parent=24546 profile= "/usr/bin/ freshclam/ /null-12/ /null-13" requested_ mask=": :r" denied_mask="::r" fsuid=107 ouid=0 name="/ lib/tls/ i686/cmov/ libc-2. 11.1.so" 9.666:137) : operation= "file_mmap" pid=24547 parent=24546 profile= "/usr/bin/ freshclam/ /null-12/ /null-13" requested_ mask=": :mr" denied_mask="::mr" fsuid=107 ouid=0 name="/ lib/tls/ i686/cmov/ libc-2. 11.1.so" 9.678:138) : operation="open" pid=24547 parent=24546 profile= "/usr/bin/ freshclam/ /null-12/ /null-13" requested_ mask=": :r" denied_mask="::r" fsuid=107 ouid=0 name="/ etc/clamav/ onupdateexecute .d/" 3.918:184) : operation="exec" pid=24887 parent=24885 profile= "/usr/bin/ freshclam/ /null-12/ /null-13/ /null-14" requested_ mask=": :x" denied_mask="::x" fsuid=107 ouid=0 name="/ bin/hostname" name2=" /usr/bin/ freshclam/ /null-12/ /null-13/ /null-14/ /null-16" 3.918:185) : operation="open" pid=24887 parent=24885 profile= "/usr/bin/ freshclam/ /null-12/ /null-13/ /null-14/ /null-16" requested_ mask=": :r" denied_mask="::r" fsuid=107 ouid=0 name="/ etc/ld. so.cache" 3.918:186) : operation="open" pid=24887 parent=24885 profile= "/usr/bin/ freshclam/ /null-12/ /null-13/ /null-14/ /null-16" requested_ mask=": :r" denied_mask="::r" fsuid=107 ouid=0 name="/ lib/tls/ i686/cmov/ libnsl- 2.11.1. so" 3.918:187) : operation= "file_mmap" pid=24887 parent=24885 profile= "/usr/bin/ freshclam/ /null-12/ /null-13/ /null-14/ /null-16" requested_ mask=": :mr" denied_mask="::mr" fsuid=107 ouid=0 name="/ lib/tls/ i686/cmov/ libnsl- 2.11.1. so" 3.918:188) : operation="open" pid=24887 parent=24885 profile= "/usr/bin/ freshclam/ /null-12/ /null-13/ /null-14/ /null-16" requested_ mask=": :r" denied_mask="::r" fsuid=107 ouid=0 name="/ lib/tls/ i686/cmov/ libc-2. 11.1.so" 3.918:189) : operation= "file_mmap" pid=24887 parent=24885 profile= "/usr/bin/ freshclam/ /null-12/ /null-13/ /null-14/ /null-16" requested_ mask=": :mr" denied_mask="::mr" fsuid=107 ouid=0 name="/ lib/tls/ i686/cmov/ libc-2. 11.1.so" 3.930:190) : operation="exec" pid=24886 parent=24548 profile= "/usr/bin/ freshclam/ /null-12/ /null-13/ /null-14" requested_ mask=": :x" denied_mask="::x" fsuid=107 ouid=0 name="/ usr/bin/ mail" name2=" /usr/bin/ freshclam/ /null-12/ /null-13/ /null-14/ /null-17" 3.938:191) : operation="open" pid=24886 parent=24548 profile= "/usr/bin/ freshclam/ /null-12/ /null-13/ /null-14/ /null-17" requested_ mask=": :r" denied_mask="::r" fsuid=107 ouid=0 name="/ etc/ld. so.cache" 3.946:192) : operation="open" pid=24886 parent=24548 profile= "/usr/bin/ freshclam/ /null-12/ /null-13/ /null-14/ /null-17" requested_ mask=": :r" denied_mask="::r" fsuid=107 ouid=0 name="/ usr/lib/ libmu_cfg. so.0.0. 0" 3.950:193) : operation= "file_mmap" pid=24886 parent=24548 profile= "/usr/bin/ freshclam/ /null-12/ /null-13/ /null-14/ /null-17" requested_ mask=": :mr" denied_mask="::mr" fsuid=107 ouid=0 name="/ usr/lib/ libmu_cfg. so.0.0. 0"
[1765351.326452] type=1502 audit(127474432
[1765351.326826] type=1502 audit(127474432
[1765351.326884] type=1502 audit(127474432
[1765351.326915] type=1502 audit(127474432
[1765351.361355] type=1502 audit(127474432
[1765351.366319] type=1502 audit(127474432
[1765351.366379] type=1502 audit(127474432
[1765351.366410] type=1502 audit(127474432
[1765351.379702] type=1502 audit(127474432
[1765385.616534] __ratelimit: 135 callbacks suppressed
[1765385.616539] type=1502 audit(127474436
[1765385.619011] type=1502 audit(127474436
[1765385.619065] type=1502 audit(127474436
[1765385.619100] type=1502 audit(127474436
[1765385.619180] type=1502 audit(127474436
[1765385.619206] type=1502 audit(127474436
[1765385.630737] type=1502 audit(127474436
[1765385.639718] type=1502 audit(127474436
[1765385.646332] type=1502 audit(127474436
[1765385.649362] type=1502 audit(127474436