[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
Re: kernel event auditing for NetBSD?
On Mon, Nov 15, 2010 at 04:03:31PM -0600, Jeremy C. Reed wrote:
> On Mon, 15 Nov 2010, Antti Kantee wrote:
> > On Mon Nov 15 2010 at 14:48:37 -0600, Jeremy C. Reed wrote:
> > > It has a kernel side (of course) that would be a slow process to add all
> > > the places to report.
> > Can't you (ab)use kauth for that?
> Yes, I should have mentioned that. That might be a way to get a great
> start. (From a quick look, I am not sure which, if any, audit class is
> for authorization.)
One very good way to do this would be to write a DTrace provider for
Thor Lancelot Simon
"We cannot usually in social life pursue a single value or a single moral
aim, untroubled by the need to compromise with others." - H.L.A. Hart
Main Index |
Thread Index |