Getting the program name in audit messages

Steve Grubb sgrubb at redhat.com
Fri Apr 1 19:25:05 UTC 2005


On Friday 01 April 2005 09:50, Stephen Smalley wrote:
> If Dan or others want new information, it is reasonable to
> tell them to enable syscall auditing (after adding that information to
> it).  Telling people that they have to enable syscall auditing and
> correlate multiple audit messages to retain old information is more
> problematic.

I think we're OK with this. Where does that leave the patch?

-Steve Grubb




More information about the Linux-audit mailing list