On Thu, 2006-03-23 at 08:42 -0500, John D. Ramsdell wrote: IIRC, emacs was made optional back in FC4, part of the pruning of the base install. ed is all you need ;), and vi (vim-minimal) is there too. Plus gedit, I suppose. I think audit was made optional in FC5 because of the overhead associated with syscall auditing, even if you aren't using any syscall audit filters. It does yield a little surprise for SELinux users who just got accustomed to looking for audit.log in FC4, and we had already codified use of audit.log and ausearch in e.g. the audit2allow man page. -- Stephen Smalley National Security Agency

On Thursday 23 March 2006 13:45, Stephen Smalley wrote: Precisely. I mentioned that we needed to work on performance way back in Sept. https://www.redhat.com/archives/linux-audit/2005-September/msg00061.html Its item number 2. I put that into the RFE because I thought this would happen if we didn't address it. (That list is still open and in need of help since most if not all requests are kernel work.) If they are upgrading, the audit package should get pulled in. Only new installs would be affected. Long term, this is where we want to be. The audit log parsing library should help any tool makers job easier. I see the current situation as a temporary wrinkle that we have to work through. Jason took a stab at alleviating the performance issue, but we can't include it yet since there's a bug in it. I don't know if he'll have time in the near future to continue working on it. If someone else wants to work through the bugs in it, that would be great. If someone else wants to create an alternate patch, that would be great. But we aren't likely to get back into installed by default without something kernel side changing. -Steve

On Thu, 23 Mar 2006 08:42:46 EST, John D. Ramsdell said: Make the business case for it. What percent of users need/want Emacs? What percent of users need/want audit? (Hint - I'll bet there at least an order of magnitude, possibly two entire orders, more OpenOffice users than Emacs users). If they aren't *asking* for it, what features do the packages provide that make it worth the added overhead? (Let 'yum' suck down a copy of an emacs-sized RPM over a less-than-blazing net connection sometime, and you'll understand the desire to minimize the number of things installed by default). In particular, I can make the case that audit should *not* be installed by default on any box that has SELinux enabled by default - if auditd isn't running, then SELinux AVC messages will end up in the syslog where most people expect to find them, in a format that they can use grep and similar to deal with. If auditd is running, suddenly those messages are in their own file in /var/log/audit/, and they need to learn about ausearch and friends.....