1. 18 Feb, 2007 3 commits
    • Al Viro's avatar
      [PATCH] AUDIT_FD_PAIR · db349509
      Al Viro authored
      Provide an audit record of the descriptor pair returned by pipe() and
      socketpair().  Rewritten from the original posted to linux-audit by
      John D. Ramsdell <ramsdell@mitre.org>
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      db349509
    • Steve Grubb's avatar
      [PATCH] audit config lockdown · 6a01b07f
      Steve Grubb authored
      The following patch adds a new mode to the audit system. It uses the
      audit_enabled config option to introduce the idea of audit enabled, but
      configuration is immutable. Any attempt to change the configuration
      while in this mode is audited. To change the audit rules, you'd need to
      reboot the machine.
      
      To use this option, you'd need a modified version of auditctl and use "-e 2".
      This is intended to go at the end of the audit.rules file for people that
      want an immutable configuration.
      
      This patch also adds "res=" to a number of configuration commands that did not
      have it before.
      Signed-off-by: default avatarSteve Grubb <sgrubb@redhat.com>
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      6a01b07f
    • Steve Grubb's avatar
      [PATCH] minor update to rule add/delete messages (ver 2) · a17b4ad7
      Steve Grubb authored
      I was looking at parsing some of these messages and found that I wanted what
      it was doing next to an op= for the parser to key on. Also missing was the list
      number and results.
      Signed-off-by: default avatarSteve Grubb <sgrubb@redhat.com>
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      a17b4ad7
  2. 16 Feb, 2007 37 commits