On Wed, 24 Oct 2007 10:25:14 +0800 Ed Greshko <Ed.Greshko@xxxxxxxxxxx> wrote: > > Clearly something is being execed with argv[0] == /usr/bin/sealer, > > but I don't know what it is (and it doesn't hang around long enough > > to poke in the /proc files for it :-). > > Do you have setroubleshoot installed? Not anymore, but perhaps I haven't rebooted since removing it, so maybe what I'm seeing is a process laying around that was running before I removed all the removable selinux rpms.