exclude rule help

[LC Bruzenak]

I'm trying to create an audit rule to exclude all rsync actions when run
by a process with a certain subject type (jcdx_fsbackup_t).

Our policy allows the action to happen, however as a result we generate
a ton of audit data on file access and recreation at the target point.

Anyone have a good idea of how to discard all these events? Ideally the
caller would send in a self-generated event such as "ryncing rick/src2/
to /temp-home" or similar. This is for a dedicated file backup
procedure.

Obviously I do not want to discard all rsync events, just when launched
by our trusted program. Nor would I really want all that program's
events discarded since I want it to be able to submit proactive events
which summarize its behavior.

Below are some event samples. Other ideas are welcome also if my
approach is myopic/flawed.

Thx,
LCB. 

----
node=develop.local.austin.rr.com type=PATH msg=audit(06/22/2009 15:05:37.017:901990) : item=0 name=rick/path1/path2/path3/k4jtCX inode=203842 dev=fd:04 mode=file,600 ouid=root ogid=unknown(1106) rdev=00:00 obj=siterep_u:object_r:user_home_t:s0 
node=develop.local.austin.rr.com type=CWD msg=audit(06/22/2009 15:05:37.017:901990) :  cwd=/temp_home 
node=develop.local.austin.rr.com type=SYSCALL msg=audit(06/22/2009 15:05:37.017:901990) : arch=x86_64 syscall=lchown success=yes exit=0 a0=7ffff2994e30 a1=1f7 a2=44c a3=1 items=1 ppid=5445 pid=5446 auid=rick uid=root gid=unknown(1106) euid=root suid=root fsuid=root egid=unknown(1106) sgid=unknown(1106) fsgid=unknown(1106) tty=pts2 ses=1 comm=rsync exe=/usr/bin/rsync subj=siterep_u:siterep_r:dx_fsbackup_t:s15:c0.c1023 key=perm_mod 

...

----
node=develop.local.austin.rr.com type=PATH msg=audit(06/22/2009 15:05:37.017:901997) : item=3 name=rick/path1/path2/path3/f1 inode=203843 dev=fd:04 mode=file,444 ouid=unknown(503) ogid=unknown(1100) rdev=00:00 obj=system_u:object_r:user_home_t:s0 
node=develop.local.austin.rr.com type=PATH msg=audit(06/22/2009 15:05:37.017:901997) : item=2 name=rick/path1/path2/path3/f2 inode=203843 dev=fd:04 mode=file,444 ouid=unknown(503) ogid=unknown(1100) rdev=00:00 obj=system_u:object_r:user_home_t:s0 
node=develop.local.austin.rr.com type=PATH msg=audit(06/22/2009 15:05:37.017:901997) : item=1 name=rick/path1/path2/path3/d1 inode=203324 dev=fd:04 mode=dir,755 ouid=unknown(503) ogid=unknown(1100) rdev=00:00 obj=system_u:object_r:user_home_t:s0 
node=develop.local.austin.rr.com type=PATH msg=audit(06/22/2009 15:05:37.017:901997) : item=0 name=rick/path1/path2/path3/d2 inode=203324 dev=fd:04 mode=dir,755 ouid=unknown(503) ogid=unknown(1100) rdev=00:00 obj=system_u:object_r:user_home_t:s0 
node=develop.local.austin.rr.com type=CWD msg=audit(06/22/2009 15:05:37.017:901997) :  cwd=/temp_home 
node=develop.local.austin.rr.com type=SYSCALL msg=audit(06/22/2009 15:05:37.017:901997) : arch=x86_64 syscall=rename success=yes exit=0 a0=7ffff2994e30 a1=7ffff2996e30 a2=0 a3=0 items=4 ppid=5445 pid=5446 auid=rick uid=root gid=unknown(1106) euid=root suid=root fsuid=root egid=unknown(1106) sgid=unknown(1106) fsgid=unknown(1106) tty=pts2 ses=1 comm=rsync exe=/usr/bin/rsync subj=siterep_u:siterep_r:dx_fsbackup_t:s15:c0.c1023 key=delete 

-- 
LC (Lenny) Bruzenak
lenny at magitekltd.com