[RFC PATCH ghak10 2/3] audit: Add the audit_adjtime() function

Lenny Bruzenak lenny at magitekltd.com
Tue Jun 19 21:08:09 UTC 2018


On 06/19/2018 03:52 PM, Steve Grubb wrote:

> I think we want the modes field so that we know what was changed. But do we 
> really need to know maxerror or status? I think we should limit this to the 
> modes and any value of a time adjustment. 
>
>> Note that this new auxiliary record gets only logged on *modifying*
>> operations, which should not be that frequent, and thus it shouldn't
>> be a problem to output a bit of potentially useful information.
> We're after just security information.

+1. Sometimes more isn't merrier.
:-)
 
LCB

-- 
Lenny Bruzenak
MagitekLTD

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20180619/634d21ce/attachment.htm>


More information about the Linux-audit mailing list