1. 18 2月, 2007 3 次提交
    • A
      [PATCH] AUDIT_FD_PAIR · db349509
      Al Viro 提交于
      Provide an audit record of the descriptor pair returned by pipe() and
      socketpair().  Rewritten from the original posted to linux-audit by
      John D. Ramsdell <ramsdell@mitre.org>
      Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
      db349509
    • S
      [PATCH] audit config lockdown · 6a01b07f
      Steve Grubb 提交于
      The following patch adds a new mode to the audit system. It uses the
      audit_enabled config option to introduce the idea of audit enabled, but
      configuration is immutable. Any attempt to change the configuration
      while in this mode is audited. To change the audit rules, you'd need to
      reboot the machine.
      
      To use this option, you'd need a modified version of auditctl and use "-e 2".
      This is intended to go at the end of the audit.rules file for people that
      want an immutable configuration.
      
      This patch also adds "res=" to a number of configuration commands that did not
      have it before.
      Signed-off-by: NSteve Grubb <sgrubb@redhat.com>
      Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
      6a01b07f
    • S
      [PATCH] minor update to rule add/delete messages (ver 2) · a17b4ad7
      Steve Grubb 提交于
      I was looking at parsing some of these messages and found that I wanted what
      it was doing next to an op= for the parser to key on. Also missing was the list
      number and results.
      Signed-off-by: NSteve Grubb <sgrubb@redhat.com>
      Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
      a17b4ad7
  2. 17 2月, 2007 31 次提交
  3. 15 2月, 2007 6 次提交