public inbox for linux-audit@redhat.com
 help / color / mirror / Atom feed
From: Steve Grubb <sgrubb@redhat.com>
To: Mimi Zohar <zohar@linux.vnet.ibm.com>
Cc: David Safford <safford@watson.ibm.com>,
	linux-kernel@vger.kernel.org, James Morris <jmorris@namei.org>,
	Linux Audit <linux-audit@redhat.com>,
	Andrew Morton <akpm@linux-foundation.org>
Subject: Re: integrity: audit
Date: Fri, 6 Feb 2009 11:33:12 -0500	[thread overview]
Message-ID: <200902061133.13358.sgrubb@redhat.com> (raw)
In-Reply-To: <1233936914.3135.19.camel@localhost.localdomain>

On Friday 06 February 2009 11:15:14 am Mimi Zohar wrote:
> The integrity auditing discussions took place a while ago in August 2007
> (http://osdir.com/ml/linux.redhat.security.audit/2007-09/msg00007.html).

Thanks for the refresh. Its been so long, I forgot about this. :)  Re-reading 
the thread, we never had closure on the audit event format.


> The integrity patches are in security-testing-2.6/#next and the auditd
> patch I just posted to linux-audit. How do you suggest we go forward?

We need to go over the event format and make sure its got everything we need 
in it. We also need to review the code that touches the audit system and make 
sure its using the audit API the way we intended. I'd like to do this on the 
linux-audit mail list so there is a record of it in the audit archives.

Thanks,
-Steve

  reply	other threads:[~2009-02-06 16:33 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2009-02-06 12:43 integrity: audit Mimi Zohar
2009-02-06 15:01 ` Steve Grubb
2009-02-06 16:15   ` Mimi Zohar
2009-02-06 16:33     ` Steve Grubb [this message]
  -- strict thread matches above, loose matches on Subject: below --
2009-03-09 15:06 Mimi Zohar

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=200902061133.13358.sgrubb@redhat.com \
    --to=sgrubb@redhat.com \
    --cc=akpm@linux-foundation.org \
    --cc=jmorris@namei.org \
    --cc=linux-audit@redhat.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=safford@watson.ibm.com \
    --cc=zohar@linux.vnet.ibm.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox