Casey Schaufler napsal(a): >> If we do not get commands typed at a prompt, we have to audit by execve. > I would suggest that you'll have to do that as well so that you can tell > the difference between typed actions like these: > > # cat > /dev/null > badprogram --badthing --everyone > ^D > # > > # badprogram --badthing --everyone > > where the same typed line is a Bad Thing in one case and completely > irrelevent in the other. The proposed patch audits each process separately, and includes a part of the command name in the audit event, so it is easy to distinguish between data entered into (cat > /dev/null) and the shell.
The command name can be faked, but the actions necessary to fake the command name would be audited. Mirek - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/