lkml.org 
[lkml]   [2004]   [Mar]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH][RFC] Light-weight Auditing Framework
On Wed  3 Mar 2004 10:55:01 +0200, Muli Ben-Yehuda <mulix@mulix.org> wrote:
> I'd like to second the sentiment - for syscalltrack, we would love to
> have a framework that can be used for debugging system call events.

I should clarify to avoid any confusion. The audit framework I am
proposing does _not_ allow for generic hooking of system calls.

However, the ability to audit the call is generic in the sense that
another part of the kernel can request that an audit record be generated
for the current in-progress system call (or filtering can be used to
request that audit records be generated). Although this should be
sufficient for SELinux and other security infrastructures, as well as
many non-security uses, it would only support a subset of what
syscalltrack can do currently (i.e., audit can provide information about
the syscall, but can't be used to change the behavior of the syscall).

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 14:01    [W:1.750 / U:0.008 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site