Audit patch against 2.4.7

Previous message: Casey Schaufler: "Re: MAC before DAC vs DAC before MAC"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

offerat_private

Attached are the three patches against 2.4.7 (ChangeSetat_private)

The three are 

sgi-1-add-fds
sgi-2-post-hooks
sgi-3-misc

Pending ongoing discussion regarding the positioning of the hooks relative
to the in-kernel code, I've dropped the mac-before-dac patch.

While sgi-5-truncate is needed for audit, as it stands, with only one
placement of the truncate() hook, its change seems gratutious. Once the
first three patches are accepted, I'll run through the fs code that we
originally shipped (the bumper patch) and see if there are any other hooks
in there that would be useful for non-audit (ie chroot(), chmod() ).
Consider sgi-5-truncate pending until that time when it will be folded into
a new proposal. 

If anyone else thinks that some of the originally proposed new hooks were
useful for other things than audit then let the list know and we'll
concentrate on getting those brought up to TOT. That's not trying to get
audit into phase 1 (I'm not _that_ stupid ;-), but if stuff is useful to
others then making so it would work with audit makes sense (if it can be
done cleanly).

richard.

-----------------------------------------------------------------------
Richard Offer                     Technical Lead, Trust Technology, SGI
"Specialization is for insects"
_______________________________________________________________________