Re: kernel event auditing for NetBSD?

["Jeremy C. Reed" <reed%reedmedia.net@localhost>]

On Mon, 15 Nov 2010, Antti Kantee wrote:

> On Mon Nov 15 2010 at 14:48:37 -0600, Jeremy C. Reed wrote:
> > It has a kernel side (of course) that would be a slow process to add all 
> > the places to report.
> 
> Can't you (ab)use kauth for that?

Yes, I should have mentioned that. That might be a way to get a great 
start. (From a quick look, I am not sure which, if any, audit class is 
for authorization.)