[PATCH] (1/2) new audit filter allows excluding messages by type (kernel)

[Steve Grubb]

On Wednesday 02 November 2005 10:47, David Woodhouse wrote:
> But it's not clear that this filtering is of the same nature -- can you
> explain the anticipated use case and show why it's necessary to add this
> particular filter to the _kernel_ instead of doing it in userspace?

The main use case is to allow the admin to reject certain classes of records. 
Perhaps they do not want to have any LSPP record or SE Linux avc messages. 
They could have the kernel to filter those out. There are still people that 
do not run the audit daemon and do not want avcs in their syslogs or on their 
screens. This allows them to shut it off.

This also allows an admin to tune what information is going to the audit 
daemon when the system is very busy and is overwhelming the audit daemon. For 
some people having syscalls go onto wait queue is not something they want. 
They would like a fine grained way to pick what gets kept. This allows it.

There was a proposal put out here:

https://www.redhat.com/archives/linux-audit/2005-September/msg00061.html

There were no comments saying no one should do this. If anyone has objections 
to anything on that list, please discuss it now before people waste their 
time on something that will be rejected.

-Steve