http://people.fedoraproject.org/~dwalsh/SELinux/F14/roles_auditadm.patch Auditadmin should be able to connect to the syslog. Dontaudit search /root.