--- Lisa Smith <[EMAIL PROTECTED]> wrote:
> Hi, > > Attached is the design proposal for the audit > failure action project. > Please review it and send me any comments. I would expect these facilties to be included in the audit daemon along with other real-time event processing. I would not expect an application or application system such as cups to be integrated into the processing of audit events. Consider the MLS implications for starters. What sensitivity ought to be applied to an audit event? Is it appropriate to send cups an event at that sensitivity, and if so, what ought it do with it, and how sure can you be that you haven't designed in a data channel? The audit daemon can make those choices and is the correct place to put such processing. Casey Schaufler [EMAIL PROTECTED] -- redhat-lspp mailing list [EMAIL PROTECTED] https://www.redhat.com/mailman/listinfo/redhat-lspp
