From mboxrd@z Thu Jan  1 00:00:00 1970
From: Matthew Booth <mbooth@redhat.com>
Subject: CAP_AUDIT_CONTROL in RHEL4
Date: Tue, 26 Jun 2007 19:09:34 +0100
Message-ID: <1182881374.12678.3.camel@localhost.localdomain>
Mime-Version: 1.0
Content-Type: multipart/mixed; boundary="===============1671296373=="
Return-path: <linux-audit-bounces@redhat.com>
Received: from [10.182.7.105] (sebastian-int.corp.redhat.com [172.16.52.221])
	by pobox.fab.redhat.com (8.13.1/8.13.1) with ESMTP id l5QKFPv8013953
	for <linux-audit@redhat.com>; Tue, 26 Jun 2007 16:15:26 -0400
List-Unsubscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: linux-audit <linux-audit@redhat.com>
List-Id: linux-audit@redhat.com


--===============1671296373==
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature";
	boundary="=-s2pzIxE5+Hqvdn3q6ChM"


--=-s2pzIxE5+Hqvdn3q6ChM
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

I've got my own process listening directly for audit events on the
netlink interface. I'd like to drop its privileges for normal operation.
However, under certain circumstances it has to enable or disable
auditing, which requires CAP_AUDIT_CONTROL. I can't work out how to
create a cap_t with this capability. I've tried:

cap_from_text("CAP_AUDIT_CONTROL=3Dpe") and
cap_from_text("cap_audit_control=3Dpe") and
cap_from_text("30=3Dpe")

However in all cases I get EINVAL. What am I doing wrong?

Thanks,

Matt
--=20
Matthew Booth, RHCA, RHCSS
Red Hat, Global Professional Services

M:       +44 (0)7977 267231
GPG ID:  D33C3490
GPG FPR: 3733 612D 2D05 5458 8A8A 1600 3441 EA19 D33C 3490

--=-s2pzIxE5+Hqvdn3q6ChM
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)

iD8DBQBGgVZeNEHqGdM8NJARAiqhAJ441uy8rO1gxrCR+scX2t3mdkeP0ACdEf4Z
mI6UrcbGwTqpXo5ak2VgrLw=
=r9We
-----END PGP SIGNATURE-----

--=-s2pzIxE5+Hqvdn3q6ChM--


--===============1671296373==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


--===============1671296373==--