[redhat-lspp] [PATCH] promiscuous mode

schaufler-ca.com - Casey Schaufler casey at schaufler-ca.com
Mon Dec 5 17:03:04 UTC 2005


Steve Grubb wrote:

> The only places I want to get my hands on are:
> promiscuous mode change,

Which is prudent, but I'm surprised this already covered.

>  quota violations, and rlimit violations.

Aw, in the Unix world we went to great lengths
to demonstrate that these are NOT security policy
enforcement issues and this not interesting to
audit. I recommend against auditing these events
unless you're prepared to devise and document a
security policy that requires them. We didn't do it.




------------------------
Casey Schaufler
casey at schaufler-ca.com
650.906.1780










More information about the redhat-lspp mailing list