lkml.org 
[lkml]   [2006]   [Apr]   [6]   [last100]   RSS Feed
Views: [more markup]  [less markup]  [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: Q on audit, audit-syscall
From Valdis.Kletnieks@vt ...
DateThu, 06 Apr 2006 00:24:33 -0400
On Wed, 05 Apr 2006 23:47:24 +0200, Herbert Rosmanith said:

> anyway, the manpage describes how auditd/libaudit works - not how it has been
> implemented/how it communicates with the kernel.
> I want to know how it works "under the hood", not just how to use it.

One thing that's not at all clear from casual reading of the source code
of either the kernel or the userspace, or most of the existing docs...

The audit facility is *very much* an after-the-fact logging - there are a
few places where the code jumps through very odd hoops to deal with the fact
that by the time an actual notification is generated, the entire process that
triggered the event could be *gone*, completely and totally.
[unhandled content-type:application/pgp-signature]
\
 
 \ /
  Last update: 2006-04-06 06:27    [from the cache]
©2003-2008