---
id: RHEL-07-030444
status: implemented
tag: auditd
---

The tasks add a rule to auditd that logs each time the ``restorecon`` command
is used.

Deployers can opt-out of this change by setting an Ansible variable:

.. code-block:: yaml

    security_rhel7_audit_restorecon: no