You also need the kernel change: https://bitbucket.org/billcroberts/kernel-msm/commits/937eed8878ac2a3240d2e551e42a984029ce746d?at=seandroid-msm-mako-3.4-jb-mr1.1-auditlogsplit
On Tue, Nov 12, 2013 at 6:19 PM, Jaejyn Shin <[email protected]> wrote: > Thank for your direction. > I found the commit of Bill Roberts ( > https://bitbucket.org/billcroberts/system-core/commits/2d9108dde0fa81592d51968ee7002fb32e14f6cd > ) > > The reason why I want to do it is, I want to show the violation logs to > application developer who do not want to see the kernel logs but the kernel > log which have violation logs is needed to me to handle SEAndroid. > > To modify some policies or find the solution, I want to see the kernel > logs around violation logs. > > Thank you > Best regards > > 2013/11/13 Stephen Smalley <[email protected]> > >> On 11/10/2013 07:47 PM, Jaejyn Shin wrote: >> > Thank you for your advice. >> > >> > Yes. I patched auditd to my kernel referring >> > http://selinuxproject.org/page/NB_SEforAndroid_1#auditd_Daemon >> > >> > I am finding writing logs to both sides (/data/misc/audit and kernel >> log) >> > but it is not easy to find the way. >> >> Requires a kernel patch to support. Bill Roberts posted a patch and >> uploaded it to gerrit a while back to support that functionality, but it >> wasn't taken. I wasn't clear why you would want that to happen. >> >> >> > -- Respectfully, William C Roberts
