which kernel config is required?

Steve Grubb sgrubb at redhat.com
Thu Oct 25 13:59:34 UTC 2007


On Wednesday 24 October 2007 07:43:01 pm MontyRee wrote:
> But I don't use rpm based kernel which installed automatically from the CD
> but downloading the kernel source from the kernel.org site and compiles the
> kernel. 

Part of the value that a distribution provides is coordinating all the pieces 
to work together. When you do your own upgrades outside of the distribution, 
you have to know a whole lot about how the whole thing works.

If you want cutting edge system, I recommend going to F8t3 also known as 
rawhide and F8 as soon as that is released. All the pieces are coordinated so 
they work together. If you want something recent and very stable, look to 
RHEL5 or its derivatives. If you want something well tested and stable, use 
RHEL4 or its derivatives. 

But you cannot mix kernels between RHEL4 & 5. Even replacing the audit daemon 
might not be enough. I suspect you will have to recompile everything that 
depends on libaudit.

> So I can use 2.6.19 or 2.6.23, but I don't know which menu should 
> be selected to use full auditd function?

In recent kernels, I think the setting you mentioned in the first email is all 
you need.

> Surely, I will use RHEL 5 based system sooner, but I must do kernel compile
> for some reason.

I really don't know if you can mix 2.6.23 with RHEL5. There are big changes in 
hotplug, for example, and other things that the packages shipped with RHEL5 
(udev/hal) might not work with. You'll have to try it to find out. But 
another reason to stick with a distribution's kernel is that not even the 
2.6.23 kernel has all the audit pieces that the RHEL5.1 kernel has. They are 
merging with the 2.6.24 kernel.

> you mean File systems  ---> Filesystem in Userspace support?

Nope. I was talking about the actual RHEL4 kernel, not 2.6.23.

Good Luck...

-Steve




More information about the Linux-audit mailing list