From: Steve Grubb <sgrubb@redhat.com>
To: Derek Warner <derek.warner@riptidesoftware.com>
Cc: linux-audit@redhat.com
Subject: Re: Exclude /usr/libexec/mysqld from audit.rules
Date: Mon, 09 Dec 2013 10:34:19 -0500 [thread overview]
Message-ID: <10198302.85ZcV1VRhC@x2> (raw)
In-Reply-To: <CAPZ=o6q6Z3Fh+kT7AOzQ-Ka3NtGK0dXBCOPMwRX8g1RN4yyb0A@mail.gmail.com>
On Monday, December 09, 2013 10:20:41 AM Derek Warner wrote:
> How did you "interpret" the log setting to retreive the syscall
> "sched_setparam"?
I copied the text and ran it through ausearch with the '-i' commandline
option.
> Anyhow I am not sure why we want this, I have no idea what the
> sched_setparam actually does.
It changes the priority of the process. Which is not exactly security
critical. For concerns in this area, one would generally set rlimits to
prevent a resource hog. Additionally, if you really, really wanted to see
this, you'd only want the ones that succeed or fail due to EPERM.
>Did you do a lookup on the mysql syscall number?
No, I used the audit tools to check it.
-Steve
next prev parent reply other threads:[~2013-12-09 15:34 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-12-06 20:34 Exclude /usr/libexec/mysqld from audit.rules Derek Warner
2013-12-09 14:32 ` Steve Grubb
2013-12-09 15:20 ` Derek Warner
2013-12-09 15:34 ` Steve Grubb [this message]
2013-12-09 15:59 ` Derek Warner
2013-12-09 15:34 ` Derek Warner
2013-12-09 16:22 ` Steve Grubb
2013-12-10 17:54 ` Derek Warner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=10198302.85ZcV1VRhC@x2 \
--to=sgrubb@redhat.com \
--cc=derek.warner@riptidesoftware.com \
--cc=linux-audit@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox