Re: [PATCH 1/2] audit: log binding and unbinding to netlink multicast socket

2015-07-24 Thread Paul Moore
On Thursday, July 23, 2015 04:45:10 PM Steve Grubb wrote: The audit subsystem could use a function that logs the commonly needed fields for a typical audit event. This logs less that audit_log_task_info and reduces the need to hand code individual fields. Signed-off-by: Steve Grubb

Re: Audit class/lab

2015-07-24 Thread Burn Alting
Steve, The agenda infers that to attend a lab, you must bring a wifi-capable laptop with an SSH client installed. Is this a requirement for your lab or just the Applied SCAP Lab? Regards On Thu, 2015-07-16 at 14:12 -0400, Steve Grubb wrote: On Thursday, July 16, 2015 05:03:26 PM Smith, Gary R

Re: [PATCH 2/2] audit: log binding and unbinding to netlink multicast socket

2015-07-24 Thread Paul Moore
On Thursday, July 23, 2015 04:45:19 PM Steve Grubb wrote: Log information about programs connecting and disconnecting to the audit netlink multicast socket. This is needed so that during investigations a security officer can tell who or what had access to the audit trail. This helps to meet