From: Steve Grubb <sgrubb@redhat.com>
To: linux-audit@redhat.com
Subject: Re: reactive audit proposal
Date: Wed, 13 May 2020 14:03:27 -0400 [thread overview]
Message-ID: <7295083.E8dtrJcxLY@x2> (raw)
In-Reply-To: <2037581034.269445.1589390222295@mail.yahoo.com>
On Wednesday, May 13, 2020 1:17:02 PM EDT Joe Wulf wrote:
> What you propose is a sound enhancement.
> I have no preference for the choice between incorporate this in the audit
> daemon versus a plugin.What would be the effort to switch from one to the
> other if later on you should find the first choice wasn't as optimal?
Well, the main idea for a plugin is not to stop processing events. Busy
systems need to keep focused on unloading the kernel backlog.
> I wonder about the case where a system is booted with new media already
> attached.
During initialization, it runs through the mount table just as if the mount
table was changed. So, it has the opportunity to apply rules during init. I'm
borrowing code from fapolicyd which has this nicely solved. (It's one of my
other projects.)
-Steve
--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit
next prev parent reply other threads:[~2020-05-13 18:03 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-05-13 0:22 reactive audit proposal Steve Grubb
2020-05-13 0:31 ` Joe Nall
2020-05-13 0:36 ` Steve Grubb
2020-05-13 16:47 ` Joe Nall
[not found] ` <2037581034.269445.1589390222295@mail.yahoo.com>
2020-05-13 18:03 ` Steve Grubb [this message]
2020-05-14 8:55 ` Burn Alting
2020-05-14 13:32 ` Richard Guy Briggs
2020-05-14 14:47 ` Steve Grubb
2020-05-14 15:14 ` Richard Guy Briggs
2020-05-15 15:00 ` Lenny Bruzenak
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=7295083.E8dtrJcxLY@x2 \
--to=sgrubb@redhat.com \
--cc=linux-audit@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.