* DAEMON_END message subj field
@ 2006-07-27 14:51 Michael C Thompson
2006-07-27 15:06 ` Steve Grubb
0 siblings, 1 reply; 2+ messages in thread
From: Michael C Thompson @ 2006-07-27 14:51 UTC (permalink / raw)
To: Linux Audit, Steve Grubb
Hey Steve,
In the DAEMON_END message, it seems like the subj context is cut short:
type=DAEMON_END msg=audit(1153997923.281:9429) auditd normal halt,
sending auid=0 pid=3218 subj=root:staff_r:staff, auditd pid=3209
vs
type=CONFIG_CHANGE msg=audit(1153997824.379:314): audit_enabled=1 old=1
by auid=0 subj=root:staff_r:staff_t:s0-s15:c0.c255
CONFIG_CHANGE and others include the MLS label, but DAEMON_END does
not... is this by design or an oversight?
Thanks,
Mike
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: DAEMON_END message subj field
2006-07-27 14:51 DAEMON_END message subj field Michael C Thompson
@ 2006-07-27 15:06 ` Steve Grubb
0 siblings, 0 replies; 2+ messages in thread
From: Steve Grubb @ 2006-07-27 15:06 UTC (permalink / raw)
To: Michael C Thompson; +Cc: Linux Audit
On Thursday 27 July 2006 10:51, Michael C Thompson wrote:
> Hey Steve,
>
> In the DAEMON_END message, it seems like the subj context is cut short:
Will fix.
> CONFIG_CHANGE and others include the MLS label, but DAEMON_END does
> not... is this by design or an oversight?
I haven't worked on this. You're testing for things I haven't had a chance to
address. :) I'll fix this in next update.
-Steve
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2006-07-27 15:06 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2006-07-27 14:51 DAEMON_END message subj field Michael C Thompson
2006-07-27 15:06 ` Steve Grubb
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.