[PATCH] audit: documentation of audit= kernel parameter

[PATCH] audit: documentation of audit= kernel parameter

[Eric Paris]

Further documentation of the 3 possible kernel value of the audit
command line option.

Signed-off-by: Eric Paris <eparis@redhat.com>
---
 Documentation/kernel-parameters.txt | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index ab86766..5867442 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -465,6 +465,14 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
 
 	audit=		[KNL] Enable the audit sub-system
 			Format: { "0" | "1" } (0 = disabled, 1 = enabled)
+			0 - kernel audit is disabled and can not be enabled
+			    until the next reboot
+			unset - kernel audit is partially enabled and will
+			    be fully enabled by the userspace auditd
+			1 - kernel audit is partially enabled just like 'unset'
+			    only at most audit_backlog_limit messages will be
+			    retained in RAM and forwarded to userspace auditd
+			    when it being.
 			Default: unset
 			
 	audit_backlog_limit= [KNL] Set the audit queue size limit.
-- 
1.8.4.2

Re: [PATCH] audit: documentation of audit= kernel parameter

[Richard Guy Briggs]

On 14/01/13, Eric Paris wrote:
> Further documentation of the 3 possible kernel value of the audit
> command line option.
> 
> Signed-off-by: Eric Paris <eparis@redhat.com>
> ---
>  Documentation/kernel-parameters.txt | 8 ++++++++
>  1 file changed, 8 insertions(+)
> 
> diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
> index ab86766..5867442 100644
> --- a/Documentation/kernel-parameters.txt
> +++ b/Documentation/kernel-parameters.txt
> @@ -465,6 +465,14 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
>  
>  	audit=		[KNL] Enable the audit sub-system
>  			Format: { "0" | "1" } (0 = disabled, 1 = enabled)
> +			0 - kernel audit is disabled and can not be enabled
> +			    until the next reboot
> +			unset - kernel audit is partially enabled and will
> +			    be fully enabled by the userspace auditd

How about:
			unset - kernel audit is initialized but disabled and will
			    be fully enabled by the userspace auditd

> +			1 - kernel audit is partially enabled just like 'unset'
> +			    only at most audit_backlog_limit messages will be
> +			    retained in RAM and forwarded to userspace auditd
> +			    when it being.

It looks like this sentence finished a bit prematurely...  How about
"...when available." or a rewrite:

			1 - kernel audit is initialized and partially
			    enabled, storing at most audit_backlog_limit
			    messages in RAM until it is fully enabled by
			    the userspace auditd.

>  			Default: unset
>  			
>  	audit_backlog_limit= [KNL] Set the audit queue size limit.

- RGB

--
Richard Guy Briggs <rbriggs@redhat.com>
Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545