auditing procmail?

[Valdis.Kletnieks at vt.edu]

Anybody have any good ideas on what should happen for auditing and loginuid
when Sendmail invokes procmail as a delivery agent, and we're running
essentially arbitrary code as the user from their .procmailrc?  My gut
feeling is that this *should* act just like a cron job for auditing
purposes, but the sendmail/procmail interface isn't in the least PAM-ified,
so we can't just toss in a 'session required pam_audit.so'...

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 226 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20050223/4296c11c/attachment.sig>