1. 18 2月, 2007 2 次提交
    • S
      [PATCH] audit config lockdown · 6a01b07f
      Steve Grubb 提交于
      The following patch adds a new mode to the audit system. It uses the
      audit_enabled config option to introduce the idea of audit enabled, but
      configuration is immutable. Any attempt to change the configuration
      while in this mode is audited. To change the audit rules, you'd need to
      reboot the machine.
      
      To use this option, you'd need a modified version of auditctl and use "-e 2".
      This is intended to go at the end of the audit.rules file for people that
      want an immutable configuration.
      
      This patch also adds "res=" to a number of configuration commands that did not
      have it before.
      Signed-off-by: NSteve Grubb <sgrubb@redhat.com>
      Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
      6a01b07f
    • S
      [PATCH] minor update to rule add/delete messages (ver 2) · a17b4ad7
      Steve Grubb 提交于
      I was looking at parsing some of these messages and found that I wanted what
      it was doing next to an op= for the parser to key on. Also missing was the list
      number and results.
      Signed-off-by: NSteve Grubb <sgrubb@redhat.com>
      Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
      a17b4ad7
  2. 17 2月, 2007 38 次提交