Re: Fedora Core 3 Test Update: kernel-2.6.12-1.1369_FC3

[Steve Grubb <sgrubb redhat com>]

On Tuesday 05 July 2005 09:03, Stephen Smalley wrote:
> - migration of task pid/exe logging from SELinux avc to the audit
> framework, motivated by the dcache deadlock on exe logging.  Means that
> we may need to tell people to enable syscall auditing via auditctl -e 1
> or booting their kernel with audit=1 to recapture that information for
> avc denials when they report them.

The audit daemon enables auditing as it starts. If you have the audit package 
installed and you haven't taken it out of the startup sequence, you shouldn't 
need to do anything. Otherwise, I'd recommend setting audit=1 boot parameter.

> There were also some changes to the netlink-related checking and audit
> checking, but I doubt that will have an impact on FC3.

The audit daemon has not been built for FC3.

-Steve