Re: [PATCH 2/2] audit: log binding and unbinding to netlink multicast socket

2015-07-24 Thread Paul Moore
On Thursday, July 23, 2015 04:45:19 PM Steve Grubb wrote: > Log information about programs connecting and disconnecting to the audit > netlink multicast socket. This is needed so that during investigations a > security officer can tell who or what had access to the audit trail. This > helps to meet

Re: [PATCH 1/2] audit: log binding and unbinding to netlink multicast socket

2015-07-24 Thread Paul Moore
On Thursday, July 23, 2015 04:45:10 PM Steve Grubb wrote: > The audit subsystem could use a function that logs the commonly needed > fields for a typical audit event. This logs less that audit_log_task_info > and reduces the need to hand code individual fields. > > Signed-off-by: Steve Grubb > --

Re: [PATCH 0/2] audit: log binding and unbinding to netlink multicast socket

2015-07-24 Thread Paul Moore
On Thu, Jul 23, 2015 at 4:45 PM, Steve Grubb wrote: > Hello, > > I am resurrecting this old patch. Its been cleaned up by adding a simple task > logging function which should, in the future, serve almost all kernel logging > needs. The cleaned up bind and unbind functions call it to create the pre

Re: Audit class/lab

2015-07-24 Thread Burn Alting
Steve, The agenda infers that to attend a lab, you must bring a wifi-capable laptop with an SSH client installed. Is this a requirement for your lab or just the Applied SCAP Lab? Regards On Thu, 2015-07-16 at 14:12 -0400, Steve Grubb wrote: > On Thursday, July 16, 2015 05:03:26 PM Smith, Gary R