I have the following audit message
Raw Audit Messages
type=AVC msg=audit(1687022594.74:347): avc: denied { mmap_zero } for
pid=3953 comm="check" scontext=system_u:system_r:spc_t:s0
tcontext=system_u:system_r:spc_t:s0 tclass=memprotect permissive=0
This warning gets triggered from time to time around system startup, and I
cannot find the process involved. The name check is too generic to use the
locate command and the process is no longer running by the time I would
have the chance to peek at the PID.
Thanks.