From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: [PATCH] audit=0 appears not to completely disable auditing Date: Thu, 22 Mar 2007 17:55:45 -0400 Message-ID: <200703221755.45802.sgrubb@redhat.com> References: <200703091550.11104.sgrubb@redhat.com> <20070322214519.GA15039@fc.hp.com> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <20070322214519.GA15039@fc.hp.com> Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Amy Griffis Cc: Linux Audit List-Id: linux-audit@redhat.com On Thursday 22 March 2007 17:45, Amy Griffis wrote: > When audit_enabled was first implemented, it was only intended to turn > off syscall auditing, not _all_ auditing. At that time, syscall auditing *was* all auditing. :) > This was so users could use audit for selinux messages without the overhead > of syscall audit. SE Linux has always been different and you shouldn't really consider it in the auditing system for enable/disable. The reason its different is that it uses audit as a transport mechanism and can happily use syslogs, too. > > The patch below solves this problem by checking audit_enabled before > > creating an audit event. > > If you want audit_enabled=0 to turn off audit completely, do you also > want to drop selinux messages? No, the SE Linux folks want avc messages at all times unless the admin specifically sets a rule to suppress them. -Steve