Re: [patch] Re: auditdeny is painful

[Justin Smith <jsmith@mcs.drexel.edu>]

I'll jump into the thread and add my $.02:

The permission denied messages can be an excellent intrusion detection
system (like tripwire). If one eliminates denials that are innocent
(programs accessing files they don't need to), the remaining ones can
give a pretty good picture of what is going on in one's system. And this
approach is much more refined than tripwire: it doesn't scan huge chunks
of file systems to see what changes. Instead, it intercepts  system
calls that attempt to make the changes.

On several occasions, I've noticed illicit attempts to access my student
records database. Although (I think) these attempts would have failed
without SELinux (because of standard unix permissions), I also wouldn't
have gotten such clear indications of it.
-- 


--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.