dbusd avc audit messages are generated by libselinux using a callback function provided by dbusd, and dbusd likely is just using syslog() rather than communicating with the audit daemon.
I traced through the code and created a patch for dbus to use libaudit. It now works fine. But, I noticed the kernel generated messages have more information in them. I guess that's what the audit hook (avc_func_audit) was for.
-Steve Grubb
__________________________________ Do you Yahoo!? Yahoo! Mail - Helps protect you from nasty viruses. http://promotions.yahoo.com/new_mail