From: Steve Grubb <sgrubb@redhat.com>
To: Maupertuis Philippe <philippe.maupertuis@worldline.com>
Cc: "linux-audit@redhat.com" <linux-audit@redhat.com>
Subject: Re: Setting loginuid for a process starting at boot
Date: Tue, 14 Jan 2014 11:15:51 -0500 [thread overview]
Message-ID: <9789134.Zx7fPC2q5J@x2> (raw)
In-Reply-To: <A35547AE65CDA84F93D4012BDFB5D5553DBFE5BBE2@FRVDX100.fr01.awl.atosorigin.net>
On Tuesday, January 14, 2014 04:55:30 PM Maupertuis Philippe wrote:
> Where can I find the description and the trigger of all messages types if
> such a documentation exists ?
To some extent, the documentation is in the header files. They describe what
the intended use is for the event record types.
https://fedorahosted.org/audit/browser/trunk/lib/libaudit.h#L40
https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/tree/include/uapi/linux/audit.h?id=refs/tags/v3.12.7#n30
As for what triggers them, it can mostly be deduced from the event's type.
However, some user space apps that do the same thing as others may not
have been updated to do auditing and various distributions may or may not
enable the auditing at build time. So, the user space support varies.
-Steve
prev parent reply other threads:[~2014-01-14 16:15 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-01-12 22:00 Setting loginuid for a process starting at boot Maupertuis Philippe
2014-01-13 20:12 ` Eric Paris
2014-01-13 20:16 ` Steve Grubb
2014-01-13 21:17 ` RE : " Maupertuis Philippe
2014-01-13 22:05 ` Steve Grubb
2014-01-14 13:13 ` Maupertuis Philippe
2014-01-14 14:33 ` Steve Grubb
2014-01-14 15:55 ` Maupertuis Philippe
2014-01-14 16:15 ` Steve Grubb [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=9789134.Zx7fPC2q5J@x2 \
--to=sgrubb@redhat.com \
--cc=linux-audit@redhat.com \
--cc=philippe.maupertuis@worldline.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).