audit on Fedora Core 5

[Stephen Smalley]

On Thu, 2006-03-23 at 08:42 -0500, John D. Ramsdell wrote:
> I installed FC5 on several machines by selecting the options office
> products, software development, and web server, and customize later.
> I was very surprised to discover that the audit and emacs packages
> were not installed.  You'd think that both audit and emacs would be
> part of the base system, independent of what options are specified.

IIRC, emacs was made optional back in FC4, part of the pruning of the
base install.   ed is all you need ;), and vi (vim-minimal) is there
too.  Plus gedit, I suppose.

I think audit was made optional in FC5 because of the overhead
associated with syscall auditing, even if you aren't using any syscall
audit filters.  It does yield a little surprise for SELinux users who
just got accustomed to looking for audit.log in FC4, and we had already
codified use of audit.log and ausearch in e.g. the audit2allow man page.

-- 
Stephen Smalley
National Security Agency