Re: [redhat-lspp] [PATCH] promiscuous mode
Steve Grubb wrote:
The only places I want to get my hands on are:
promiscuous mode change,
Which is prudent, but I'm surprised this already covered.
quota violations, and rlimit violations.
Aw, in the Unix world we went to great lengths
to demonstrate that these are NOT security policy
enforcement issues and this not interesting to
audit. I recommend against auditing these events
unless you're prepared to devise and document a
security policy that requires them. We didn't do it.
------------------------
Casey Schaufler
casey(a)schaufler-ca.com
650.906.1780