[RFC PATCH ghak10 2/3] audit: Add the audit_adjtime() function
Lenny Bruzenak
lenny at magitekltd.com
Tue Jun 19 21:08:09 UTC 2018
On 06/19/2018 03:52 PM, Steve Grubb wrote:
> I think we want the modes field so that we know what was changed. But do we
> really need to know maxerror or status? I think we should limit this to the
> modes and any value of a time adjustment.
>
>> Note that this new auxiliary record gets only logged on *modifying*
>> operations, which should not be that frequent, and thus it shouldn't
>> be a problem to output a bit of potentially useful information.
> We're after just security information.
+1. Sometimes more isn't merrier.
:-)
LCB
--
Lenny Bruzenak
MagitekLTD
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20180619/634d21ce/attachment.htm>
More information about the Linux-audit
mailing list