Linux-audit December 2005

linux-audit@lists.linux-audit.osci.io

13 participants
14 discussions

by Steve Grubb

On Tuesday 08 November 2005 10:32, Steve Grubb wrote: > I think we need to add some SE Linux kernel message types for audit into > the kernel and start patching the kernel to report these messages - > including the information of previous value and new value. Attached is a patch that hardwires important SE Linux events to the audit system. Please Apply. Signed-off-by: Steve Grubb <sgrubb(a)redhat.com>

18 years, 11 months

3
3
0 / 0

audit-1.1.2 released

by Steve Grubb

I've just released a new version of the audit daemon. It can be downloaded from http://people.redhat.com/sgrubb/audit It will also be in rawhide tomorrow. The Changelog is: - Add new message types Not a lot of changes in this release. -Steve

18 years, 11 months

1
0
0 / 0

Re: [redhat-lspp] [PATCH] promiscuous mode

by schaufler-ca.com - Casey Schaufler

Steve Grubb wrote: > The only places I want to get my hands on are: > promiscuous mode change, Which is prudent, but I'm surprised this already covered. > quota violations, and rlimit violations. Aw, in the Unix world we went to great lengths to demonstrate that these are NOT security policy enforcement issues and this not interesting to audit. I recommend against auditing these events unless you're prepared to devise and document a security policy that requires them. We didn't do it. ------------------------ Casey Schaufler casey(a)schaufler-ca.com 650.906.1780

18 years, 11 months

1
0
0 / 0

[PATCH] audit quota violations

by Steve Grubb

Hi, Attached is a patch to start collecting audit events for quota violations. I'm interested in feedback as to whether memory allocation should be gfp_atomic at this spot and if the placement is correct. Thanks, -Steve

18 years, 11 months

1
0
0 / 0

← Newer
1
2
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Linux-audit December 2005