From mboxrd@z Thu Jan  1 00:00:00 1970
From: Richard Guy Briggs <rgb@redhat.com>
Subject: Re: Early processes (daemons) do not report audit events
Date: Fri, 11 Sep 2015 05:50:27 -0400
Message-ID: <20150911095027.GO8140@madcap2.tricolour.ca>
References: <1E6087D5-E362-4795-BD8D-1374831498E4@gmail.com>
	<087AE25B-79B6-4E7A-BE4B-901BE95FB81B@gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
Return-path: <linux-audit-bounces@redhat.com>
Content-Disposition: inline
In-Reply-To: <087AE25B-79B6-4E7A-BE4B-901BE95FB81B@gmail.com>
List-Unsubscribe: <https://www.redhat.com/mailman/options/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: Kangkook Jee <aixer77@gmail.com>
Cc: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

T24gMTUvMDkvMTAsIEthbmdrb29rIEplZSB3cm90ZToKPiBIaSBhbGwsCj4gCj4gSSBkZWJ1Z2dl
ZCBhIGJpdCBmdXJ0aGVyIHRvIGlkZW50aWZ5IGRpc3RyaWJ1dGlvbnMgdGhhdCBhcmUgYWZmZWN0
ZWQgYnkgdGhlIGlzc3VlLgo+IEkgcmVwZWF0ZWQgdGhlIHNhbWUgZXhwZXJpbWVudCB3aXRoIHNz
aGQgZnJvbSAzIG1vcmUgZGlzdHJpYnV0aW9ucy4KPiAKPiBDZW50T1MgTGludXggcmVsZWFzZSA3
LjEuMTUwMyAoNjQtYml0LCAzLjEwLjAtMjI5LmVsNy54ODZfNjQpOiBQcm9ibGVtIE5PVCByZXBy
b2R1Y2VkCj4gQ2VudE9TIHJlbGVhc2UgNi42ICg2NC1iaXQsIDIuNi4zMi01MDQuZWw2Lng4Nl82
NCk6IFByb2JsZW0gTk9UIHJlcHJvZHVjZWQKPiBVYnVudHUgMTIuMDQuNSBMVFMgKDY0LWJpdCwg
My4xMy4wLTMyLWdlbmVyaWMpOiBQcm9ibGVtIHJlcHJvZHVjZWQKCkZvciBlYWNoIG9mIHRoZXNl
IGV4YW1wbGVzLCB3aGF0IGlzIHRoZSB2YWx1ZSBvZiB0aGUga2VybmVsIGNvbW1hbmQgbGluZQoi
YXVkaXQ9PHZhbHVlPiIgaWYgaXQgaXMgZXZlbiBwcmVzZW50PyAgSXQgaXMgcG9zc2libGUgdGhh
dCB0aGUgQ2VudE9TCmV4YW1wbGVzIGluY2x1ZGUgImF1ZGl0PTEiIHdoaWxlIFVidW50dSBvbWl0
cyB0aGUgbGluZS4gICJjYXQKL3Byb2MvY21kbGluZSIgc2hvdWxkIHRlbGwgeW91IHRoZSBhbnN3
ZXIuCgo+IEFmdGVyIGFsbCwgVWJ1bnR1IGZhbWlseSBhcmUgYWZmZWN0ZWQgYnkgdGhlIGlzc3Vl
IGFuZCBJIGNvdWxkIGNvbmZpcm0KPiB0aGF0IHJlc3VsdHMgYXJlIGluY29uc2lzdGVudCBhY3Jv
c3MgdHdvIGRpZmZlcmVudCBkaXN0cmlidXRpb24KPiBmYW1pbGllcy4gCgpJIHdvdWxkIGJlIGN1
cmlvdXMgd2hhdCB5b3VyIHJlc3VsdHMgYXJlIHdpdGggYSByZWNlbnQgRGViaWFuIGFuZCB3aXRo
IGEKcmVjZW50IEZlZG9yYS4KCj4gSWYgeW91IGNhbiBsZXQgdXMga25vdyBob3cgY2FuIHdlIHdv
cmthcm91bmQgdGhlIGlzc3VlLCBpdCB3aWxsIGJlIGEgZ3JlYXQgaGVscC4KPiAKPiBSZWdhcmRz
LCBLYW5na29vawo+IAo+IAo+ID4gT24gU2VwIDksIDIwMTUsIGF0IDExOjUwIFBNLCBLYW5na29v
ayBKZWUgPGFpeGVyNzdAZ21haWwuY29tPiB3cm90ZToKPiA+IAo+ID4gRGVhciBhbGwsCj4gPiAK
PiA+IFdlIGFyZSBkZXZlbG9waW5nIGN1c3RvbSB1c2VyIHNwYWNlIGF1ZGl0IGFnZW50IHRvIGdh
dGhlciBzeXN0ZW0gd2lkZSBzeXN0ZW0KPiA+IGNhbGwgdHJhY2UuIFdoaWxlIGV4cGVyaW1lbnRp
bmcgd2l0aCB2YXJpb3VzIHByb2dyYW1zLCB3ZSBmb3VuZCBvdXQgdGhhdAo+ID4gcHJvY2Vzc2Vz
IChkYWVtb25zKSB0aGF0IHN0YXJ0ZWQgZWFybHkgKGFsb25nIHdpdGggdGhlIHN5c3RlbSBib290
c3RyYXBwaW5nKSBkbwo+ID4gbm90IHJlcG9ydCBhbnkgYXVkaXQgZXZlbnRzIGF0IGFsbC4gVGhl
c2UgcHJvY2Vzc2VzIHR5cGljYWxseSBmYWxsIGludG8gUElECj4gPiByYW5nZSBvZiBsZXNzIHRo
YW4gMjAwMC4gSGVyZeKAmXMgaG93IEkgcmVwcm9kdWNlZCB0aGUgc3ltcHRvbSB3aXRoIHNzaGQg
ZGFlbW9uLgo+ID4gCj4gPiAxLiBSZWJvb3QgdGhlIHN5c3RlbQo+ID4gCj4gPiAyLiBBZGQgYW5k
IGVuYWJsZSBhdWRpdCBldmVudHMKPiA+ICAgICMgL3NiaW4vYXVkaXRjdGwgLWEgZXhpdCxhbHdh
eXMgLUYgYXJjaD1iNjQgLVMgY2xvbmUgLVMgY2xvc2UgLVMgY3JlYXQgLVMgZHVwCj4gPiAgICAg
ICAgICAgLVMgZHVwMiAtUyBkdXAzIC1TIGV4ZWN2ZSAtUyBleGl0IC1TIGV4aXRfZ3JvdXAgLVMg
Zm9yayAtUyBvcGVuIC1TIG9wZW5hdCAKPiA+ICAgICAgICAgICAtUyB1bmxpbmsgLVMgdW5saW5r
YXQgLVMgdmZvcmsgLVMgMjg4IC1TIGFjY2VwdCAtUyBiaW5kIC1TIGNvbm5lY3QgCj4gPiAgICAg
ICAgICAgLVMgbGlzdGVuIC1TIHNvY2tldCAtUyBzb2NrZXRwYWlyCj4gPiAgICAjIC9zYmluL2F1
ZGl0Y3RsIC1lMSAtYiAxMDI0MDAKPiA+IAo+ID4gMy4gQ29ubmVjdCB0byB0aGUgc3lzdGVtIHZp
YSBzc2gKPiA+ICAgICBBdWRpdCBtZXNzYWdlcyBnZW5lcmF0ZWQgb25seSBmcm9tIGNoaWxkIHBy
b2Nlc3NlcyBhbmQgbm9uZSBhcmUgc2VlbiBmcm9tCj4gPiAgICAgdGhlIG9yaWdpbmFsIGRhZW1v
bi4KPiA+IAo+ID4gNC4gUmVzdGFydCBzc2hkIAo+ID4gICAgICMgcmVzdGFydCBzc2gKPiA+IAo+
ID4gNS4gQ29ubmVjdCBhZ2FpbiB0byB0aGUgc3lzdGVtIHZpYSBzc2gKPiA+ICAgIE5vdywgd2Ug
c2VlIGF1ZGl0IG1lc3NhZ2VzIGZyb20gYm90aCBwYXJlbnQgYW5kIGNoaWxkIHByb2Nlc3Nlcy4K
PiA+IAo+ID4gSSBkaWQgdGhlIGV4cGVyaW1lbnQgZnJvbSBVYnVudHUgMTQuMDQuMiBMVFMgZGlz
dHJpYnV0aW9uICg2NC1iaXQsIGtlcm5lbAo+ID4gdmVyc2lvbiAzLjEzLjAtNTgtZ2VuZXJpYyku
Cj4gPiAKPiA+IEkgZmlyc3Qgd29uZGVyIHdoZXRoZXIgdGhpcyBpcyBpbnRlbmRlZCBiZWhhdmlv
ciBvZiBhdWRpdCBmcmFtZXdvcmsgb3IKPiA+IG5vdC4gSWYgaXQgaXMgaW50ZW5kZWQsIEkgYWxz
byB3YW50IHRvIGtub3cgaG93IGNhbiB3ZSBjb25maWd1cmUgYXVkaXRkCj4gPiBkaWZmZXJlbnRs
eSB0byBjYXB0dXJlIHN5c3RlbSBjYWxscyBmcm9tIGFsbCBwcm9jZXNzZXMuIAo+ID4gCj4gPiBU
aGFua3MgYSBsb3QgZm9yIHlvdXIgaGVscCBpbiBhZHZhbmNlIQo+ID4gCj4gPiBSZWdhcmRzLCBL
YW5na29vawo+ID4gCj4gCgo+IC0tCj4gTGludXgtYXVkaXQgbWFpbGluZyBsaXN0Cj4gTGludXgt
YXVkaXRAcmVkaGF0LmNvbQo+IGh0dHBzOi8vd3d3LnJlZGhhdC5jb20vbWFpbG1hbi9saXN0aW5m
by9saW51eC1hdWRpdAoKCi0gUkdCCgotLQpSaWNoYXJkIEd1eSBCcmlnZ3MgPHJicmlnZ3NAcmVk
aGF0LmNvbT4KU2VuaW9yIFNvZnR3YXJlIEVuZ2luZWVyLCBLZXJuZWwgU2VjdXJpdHksIEFNRVIg
RU5HIEJhc2UgT3BlcmF0aW5nIFN5c3RlbXMsIFJlZCBIYXQKUmVtb3RlLCBPdHRhd2EsIENhbmFk
YQpWb2ljZTogKzEuNjQ3Ljc3Ny4yNjM1LCBJbnRlcm5hbDogKDgxKSAzMjYzNSwgQWx0OiArMS42
MTMuNjkzLjA2ODR4MzU0NQoKLS0KTGludXgtYXVkaXQgbWFpbGluZyBsaXN0CkxpbnV4LWF1ZGl0
QHJlZGhhdC5jb20KaHR0cHM6Ly93d3cucmVkaGF0LmNvbS9tYWlsbWFuL2xpc3RpbmZvL2xpbnV4
LWF1ZGl0