tech-security archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

Re: kernel event auditing for NetBSD?

On Mon, Nov 15, 2010 at 04:03:31PM -0600, Jeremy C. Reed wrote:
> On Mon, 15 Nov 2010, Antti Kantee wrote:
> > On Mon Nov 15 2010 at 14:48:37 -0600, Jeremy C. Reed wrote:
> > > It has a kernel side (of course) that would be a slow process to add all 
> > > the places to report.
> > 
> > Can't you (ab)use kauth for that?
> Yes, I should have mentioned that. That might be a way to get a great 
> start. (From a quick look, I am not sure which, if any, audit class is 
> for authorization.)

One very good way to do this would be to write a DTrace provider for

  Thor Lancelot Simon                               

  "We cannot usually in social life pursue a single value or a single moral
   aim, untroubled by the need to compromise with others."      - H.L.A. Hart

Home | Main Index | Thread Index | Old Index