Fwd: More audit 2.6.25 update
"Kirk Bauer" <[email protected]>
| Newsgroups | gmane.comp.log.logwatch.devel |
|---|---|
| Message-ID | <[email protected]> |
---------- Forwarded message ---------- From: Orion Poplawski <[email protected]> Date: Thu, Jun 19, 2008 at 8:17 AM Subject: More audit 2.6.25 update To: [email protected] The following: --- scripts/services/kernel 24 Mar 2008 23:31:26 -0000 1.35 +++ scripts/services/kernel 19 Jun 2008 15:15:51 -0000 @@ -70,7 +70,7 @@ if ( # filter out audit messages - these should be parsed by the audit # service - ($ThisLine =~ /^\s*audit\(/) + ($ThisLine =~ /\s*audit\(/) # following now in iptables service or ($ThisLine =~ /^Packet log: .*PROTO=/) or ($ThisLine =~ /IN=.*OUT=.*SRC=.*DST=.*PROTO=/) is needed to remove audit messages like: Jun 18 16:11:06 moa kernel: type=1400 audit(1213827066.116:4): avc: denied { ioctl } for pid=2913 comm="pam_timestamp_c" path="/home/orion/.xsession-errors" dev=0:1b ino=12310937 scontext=unconfined_u:system_r:pam_t:s0 tcontext=system_u:object_r:nfs_t:s0 tclass=file -- Orion Poplawski Technical Manager 303-415-9701 x222 NWRA/CoRA Division FAX: 303-415-9702 3380 Mitchell Lane [email protected] Boulder, CO 80301 http://www.cora.nwra.com -- Kirk Bauer <[email protected]> http://linux.kaybee.org | www.logwatch.org Author, Automating UNIX & Linux Administration