[PATCH 1/2] add SIGNAL syscall class

Steve Grubb sgrubb at redhat.com
Wed Feb 14 19:04:07 UTC 2007


On Wednesday 14 February 2007 13:24:31 Amy Griffis wrote:
> Add a syscall class for sending signals.

The intent of the syscall classes had been to make an update independent way 
of being able to specify audit rules for filesystem auditing where new 
syscalls could be added. I don't know if this grouping would be useful in 
practice. <shrug>

What I have been thinking about is a grouping for delete and close. That would 
align with requirements on security standards people have to meet.

-Steve




More information about the Linux-audit mailing list