[PATCH v3] audit: Turn off TIF_SYSCALL_AUDIT when there are no rules

Eric Paris eparis at redhat.com
Tue Feb 18 17:32:06 UTC 2014


On Mon, 2014-02-10 at 12:04 -0800, Andy Lutomirski wrote:
> On Mon, Feb 10, 2014 at 11:12 AM, Steve Grubb <sgrubb at redhat.com> wrote:

> 2. Do AVC denial messages still get logged if audit_enable == 0?  If
> not, then audit_enable is a non-starter.

They go out printk/dmesg/syslog




More information about the Linux-audit mailing list