Re: [PATCH] audit: Match SELinux context in "user" records

[Eric Paris]

On Mon, 2009-11-09 at 16:10 +0100, Miloslav TrmaÄ wrote:
> From: Miloslav Trmac <mitr@xxxxxxxxxx>
> 
> Add support for matching by security label (e.g. SELinux context) of
> the sender of an user-space audit record.
> 
> The audit filter code already allows user space to configure such
> filters, but they were ignored during evaluation.  This patch implements
> evaluation of these filters.
> 
> For example, after application of this patch, PAM authentication logs
> caused by cron can be disabled using
> 	auditctl -a user,never -F subj_type=crond_t
> 
> Signed-off-by: Miloslav Trmac <mitr@xxxxxxxxxx>

I wish there was a way to stop sending these instead of dropping them
later, but the functionality itself is not a horrid idea and this isn't
a performance hot list (like the syscall list)  so.....

Acked-by: Eric Paris <eparis@xxxxxxxxxx>

(I actually talked to Al about it already and he'll queue it up for the
next merge window)

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/