On Monday 18 July 2005 11:55, Amy Griffis wrote: I am interested in packaging something in a contrib directory. Maybe we can all help in this so there is a base line that can be tweeked for a particular security target. Great. I would be interested in seeing the config. Maybe others can comment on them. There is the issue of per arch syscall differences. I had hoped that someone somewhere would have started trying to actually use the audit system for a real CAPP style config. I think we would have heard from them on this and other issues regarding usability. No. This would be spelled out in the security target. I would imagine that all of the files in /etc that involve user accounts, machine identity, and certain config files would have a watch. I also think that syscalls won't be used too much except as related to a specific inode. Syscalls that set the machine name or time would probably be audited, but I think that's all. -Steve