[redhat-lspp] Re: sysadm vs. secadm powers

[Klaus Weidner]

On Wed, Feb 07, 2007 at 10:45:41PM -0200, Klaus Heinrich Kiwi wrote:
> Now that sysadm_r/sysadm_t has supehuman powers, I just wanted to confirm if
> the following is expected and in conformance with the ToE:
> 
> role/type       |      read     |    write to   |      run      | start/stop
>                 |   auditd.log  |   auditd.log  |    auditctl   | auditd
> sysadm          |       yes     |       yes     |       no      | yes
> secadm          |       yes     |       *no*    |       no      | no
> auditadm        |       *no*    |       no      |       yes     | *yes*

I'd expect auditadm to be able to read and write the audit log, is the
current behavior intentional?

-Klaus