On Wed, Mar 15, 2006 at 03:39:46PM -0500, Steve Grubb wrote:
On Wednesday 15 March 2006 15:33, Amy Griffis wrote:
> Why can't a user just disable syscall auditing if they aren't
> interested in adding rules?
because then the avc messages go to syslog.
Nothing should depend on syscall auditing. That is the way this audit
system was designed. If something is depending on it now, then it is
broken and needs to be fixed.
We don't need multiple ways to disable syscall auditing.
Amy