public inbox for linux-audit@redhat.com
 help / color / mirror / Atom feed
From: Steve Grubb <sgrubb@redhat.com>
To: linux-audit@redhat.com
Subject: User Account Lifecycle Auditing Specification
Date: Mon, 15 Sep 2014 17:21:17 -0400	[thread overview]
Message-ID: <47029832.9hktZUGAtl@x2> (raw)

Hello,

Recently I run across a problem where the events being sent by a program that 
enrolls users and groups was found to be not sending the right events. Some of 
the events were correct, some were wrong. In wanting to correct this problem 
(and write verification suites later) I thought it might be nice to have some 
specifications written up so that there is a common understanding that may be 
referred to. This will allow correction of misbehaving programs and people to 
better understand what this handful of events mean in a larger context.

The document was added to the audit project page. A direct link can be found 
here:

http://people.redhat.com/sgrubb/audit/user-account-lifecycle.txt

I would appreciate feedback and/or comments. I will also try to write up a 
couple other areas that need some clarification in the near future.

-Steve

             reply	other threads:[~2014-09-15 21:21 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2014-09-15 21:21 Steve Grubb [this message]
2014-09-15 23:25 ` User Account Lifecycle Auditing Specification Josh
2014-09-16  0:12   ` Steve Grubb

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=47029832.9hktZUGAtl@x2 \
    --to=sgrubb@redhat.com \
    --cc=linux-audit@redhat.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox