Re: auditctl examples?

[David Caplan <dac@tresys.com>]

Steve G wrote:
>> You said you are interested in using auditctl to do your auditing, but 
>> you can also get what you want with selinux policy.
> 
> This is true, but I wouldn't recommend that. Its too easy to make a typo and
> cause unexpected problems later. In general, people should never need to modify
> policy. It makes too many support problems when everyone has tweeked their
> policy.
> 

I suggested it because you stated in your response that auditctl does 
not support exactly what he wants to do. I agree with you that in 
general people should not have to modify their policy directly. I do 
think it is appropriate to "tweek" the policy when you have a specific 
protection/security requirement that is not addressed by the standard 
policy.

-- 
__________________________________

David Caplan     410 290 1411 x105
dac@tresys.com
Tresys Technology, LLC
8840 Stanford Blvd., Suite 2100
Columbia, MD 21045

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.