AUDIT SYSCALL kernel configuration option on ARM ?

Laszlo Papp djszapi at archlinux.us
Fri Jan 28 12:46:13 UTC 2011


On Thu, Jan 27, 2011 at 3:53 PM, Steve Grubb <sgrubb at redhat.com> wrote:
> On Thursday, January 27, 2011 07:19:16 am Laszlo Papp wrote:
>> I have just faced into this issue weeks ago.
>> This is the related thread:
>> http://www.linuxquestions.org/questions/showthread.php?p=4231159#post423115
>> 9
>>
>> Any 2 cents on the matter or plan, schedule when to fix it ?
>
> I added user space support quite a while back and asked for kernel help. No one
> answered:
>
> http://lists.fedoraproject.org/pipermail/arm/2009-October/000382.html
>
> If no one wants to help, then I have to wait until someone finally decides to fix it.
>
> -Steve

I see, Steve. Unfortunately I cannot help because I do not have too
much kernel programming experience. The real problem why I wanted to
give a glimpse for AUDIT because upstart cannot print out the process
ID information about the commands that were run from the
pre/post-start/stop section of the /etc/init/*.conf upstart config/job
files.

I has been told so that audit could be used in this special case for
my purpose. The first question is that whether or not kernel's
audit-properties can be used without the SYSCALL configuration option
- so basically just with the "default one" -  to get more accurate
information about the processes upstart launches during the boot-up.

Thank you in advance!

Best Regards,
Laszlo Papp




More information about the Linux-audit mailing list