[PATCH] New user space message types

Steve Grubb sgrubb at redhat.com
Thu Oct 20 18:35:27 UTC 2005


On Thursday 20 October 2005 14:21, Linda Knippers wrote:
> Can you describe what types of messages you'd expect to be in each
> range? 

I thought this was already discussed a while back.

> I'm unclear on what's an LSPP event and when a trusted program 
> would be expected to use the LSPP range vs. the 1100-1199 "user space
> trusted application messages", 

For example, new role changing roles. Or assigning a user to a se linux user.

> especially if the trusted program is part of the CAPP ST, the LSPP ST and
> also generally interesting. 

If its in CAPP, its a CAPP message.

> I'm also not unclear on what the anomoly related records would be.

This is related to the intrusion detection/prevention module.

-Steve




More information about the Linux-audit mailing list