Re: Patch to cleanup audit handling in policy.

["Christopher J. PeBenito" <cpebenito@tresys.com>]

On Fri, 2007-04-27 at 16:38 -0700, Steve G wrote:
> >I have removed -send_audit_msgs_pattern and replaced it with 4 functions 
> 
> I'd like to clarify what they are in case anyone thinks the names need tweeking
> 
> logging_send_audit_msg - This is for any Trusted App that needs to send audit
> events
> 
> logging_set_loginuid - This would be for entry point daemons or daemons that
> perform actions on behalf of a user (cron/at). Includes the ability to send audit
> events.
> 
> logging_set_audit - This should be for the audit daemon only
> 
> logging_set_auditctl - This is only for auditctl and autrace.

I'm not convinced that these are necessary.  The assertions in the
policy are mainly to stop people from accidentally shooting themselves
in the foot by allowing potentially dangerous access, for example,
access to /etc/shadow or raw disk access.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.