Re: audit syscall information.
On Fri, 22 Apr 2005, Olaf Kirch wrote:
You also need to intercept rtnetlink messages to catch all network
related configuration changes, but I guess you're already doing
that somewhere else.
SELinux can trigger auditing of netlink messages, but the granularity is
only the netlink family and whether it's a 'read' or 'write' operation
(for rtnetlink).
- James
--
James Morris
<jmorris(a)redhat.com>