'su -' warning in Fedora 8

Тогда наверное тебе и селинкс надо вырубить. Вот что нашел:

auditd

This saves audit records generated by the kernel. This information can be used in different ways. SELinux uses the audit daemon to record events. While there are other logging services it is recommended you leave this enabled (especially for users with SELinux enabled). Some information on how to utilize audit can be found on RH Magazine.