From mboxrd@z Thu Jan 1 00:00:00 1970 From: Richard Guy Briggs Subject: Re: [PATCH] audit: documentation of audit= kernel parameter Date: Mon, 13 Jan 2014 16:24:54 -0500 Message-ID: <20140113212454.GN13431@madcap2.tricolour.ca> References: <1389646917-27632-1-git-send-email-eparis@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Content-Disposition: inline In-Reply-To: <1389646917-27632-1-git-send-email-eparis@redhat.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Eric Paris Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com On 14/01/13, Eric Paris wrote: > Further documentation of the 3 possible kernel value of the audit > command line option. > > Signed-off-by: Eric Paris > --- > Documentation/kernel-parameters.txt | 8 ++++++++ > 1 file changed, 8 insertions(+) > > diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt > index ab86766..5867442 100644 > --- a/Documentation/kernel-parameters.txt > +++ b/Documentation/kernel-parameters.txt > @@ -465,6 +465,14 @@ bytes respectively. Such letter suffixes can also be entirely omitted. > > audit= [KNL] Enable the audit sub-system > Format: { "0" | "1" } (0 = disabled, 1 = enabled) > + 0 - kernel audit is disabled and can not be enabled > + until the next reboot > + unset - kernel audit is partially enabled and will > + be fully enabled by the userspace auditd How about: unset - kernel audit is initialized but disabled and will be fully enabled by the userspace auditd > + 1 - kernel audit is partially enabled just like 'unset' > + only at most audit_backlog_limit messages will be > + retained in RAM and forwarded to userspace auditd > + when it being. It looks like this sentence finished a bit prematurely... How about "...when available." or a rewrite: 1 - kernel audit is initialized and partially enabled, storing at most audit_backlog_limit messages in RAM until it is fully enabled by the userspace auditd. > Default: unset > > audit_backlog_limit= [KNL] Set the audit queue size limit. - RGB -- Richard Guy Briggs Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat Remote, Ottawa, Canada Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545