From: Steve Grubb <sgrubb@redhat.com>
To: Derek Warner <derek.warner@riptidesoftware.com>
Cc: linux-audit@redhat.com
Subject: Re: Exclude /usr/libexec/mysqld from audit.rules
Date: Mon, 09 Dec 2013 10:34:19 -0500 [thread overview]
Message-ID: <10198302.85ZcV1VRhC@x2> (raw)
In-Reply-To: <CAPZ=o6q6Z3Fh+kT7AOzQ-Ka3NtGK0dXBCOPMwRX8g1RN4yyb0A@mail.gmail.com>
On Monday, December 09, 2013 10:20:41 AM Derek Warner wrote:
> How did you "interpret" the log setting to retreive the syscall
> "sched_setparam"?
I copied the text and ran it through ausearch with the '-i' commandline
option.
> Anyhow I am not sure why we want this, I have no idea what the
> sched_setparam actually does.
It changes the priority of the process. Which is not exactly security
critical. For concerns in this area, one would generally set rlimits to
prevent a resource hog. Additionally, if you really, really wanted to see
this, you'd only want the ones that succeed or fail due to EPERM.
>Did you do a lookup on the mysql syscall number?
No, I used the audit tools to check it.
-Steve
next prev parent reply other threads:[~2013-12-09 15:34 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-12-06 20:34 Exclude /usr/libexec/mysqld from audit.rules Derek Warner
2013-12-09 14:32 ` Steve Grubb
2013-12-09 15:20 ` Derek Warner
2013-12-09 15:34 ` Steve Grubb [this message]
2013-12-09 15:59 ` Derek Warner
2013-12-09 15:34 ` Derek Warner
2013-12-09 16:22 ` Steve Grubb
2013-12-10 17:54 ` Derek Warner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=10198302.85ZcV1VRhC@x2 \
--to=sgrubb@redhat.com \
--cc=derek.warner@riptidesoftware.com \
--cc=linux-audit@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.