Re: Kernel auditing code reference?

["Stephen J. Smoogen" <smooge gmail com>]

On 10/5/05, Shaw, Marco <Marco Shaw aliant ca> wrote:
> I'm curious to know what this 'kernel auditing code' is.
>
> I guess it is something recently implemented.  I tried
> goggling for it, but the only thing coming up is a recent
> denial of service issue.
>
> Apart from going through the source, anyone know of any good
> sites that talk about it?
>


Depending on the version of Enterprise Linux you are using, there are
2 different auditing cores. In Red Hat Enterprise 3 there is LAUS
which was implemented by Rik Faith and some others. In RHEL 4U2 there
is auditd which is another implementation. Both are meant to implement
auditing of objects (was this file opened, was this file closed, did
they have privs, etc) for CAPP and other security regimes.



--
Stephen J Smoogen.
CSIRT/Linux System Administrator