| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Tue, 21 Oct 2014 18:30:24 -0400 From: Paul Moore <pmoore@...hat.com> To: Steve Grubb <sgrubb@...hat.com> Cc: Eric Paris <eparis@...hat.com>, Richard Guy Briggs <rgb@...hat.com>, linux-audit@...hat.com, linux-kernel@...r.kernel.org, ebiederm@...ssion.com, serge@...lyn.com, keescook@...omium.org Subject: Re: [RFC][PATCH] audit: log join and part events to the read-only multicast log socket On Tuesday, October 21, 2014 03:56:10 PM Steve Grubb wrote: > audit_log_task_info logs too much information for typical use. There are > times when you might want to know everything about what's connecting. But > in this case, we don't need anything about groups, saved uids, fsuid, or > ppid. > > Its a shame we don't have a audit_log_task_info_light function which only > records: > > pid= auid= uid= subj= comm= exe= ses= tty= This is getting back to my earlier concerns/questions about field ordering, or at the very least I'm going to hijack this conversation and steer it towards field ordering ;) Before we go to much farther, I'd really like us to agree that ordering is not important, can we do that? As a follow up, what do we need to do to make that happen in the userspace tools? -- paul moore security and virtualization @ redhat -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists