[PATCH] New user space message types
Steve Grubb
sgrubb at redhat.com
Thu Oct 20 18:35:27 UTC 2005
On Thursday 20 October 2005 14:21, Linda Knippers wrote:
> Can you describe what types of messages you'd expect to be in each
> range?
I thought this was already discussed a while back.
> I'm unclear on what's an LSPP event and when a trusted program
> would be expected to use the LSPP range vs. the 1100-1199 "user space
> trusted application messages",
For example, new role changing roles. Or assigning a user to a se linux user.
> especially if the trusted program is part of the CAPP ST, the LSPP ST and
> also generally interesting.
If its in CAPP, its a CAPP message.
> I'm also not unclear on what the anomoly related records would be.
This is related to the intrusion detection/prevention module.
-Steve
More information about the Linux-audit
mailing list