On Fri, Jun 07, 2013 at 07:03:24PM -0600, Stephen John Smoogen wrote:
> On 7 June 2013 12:29, Matthew Garrett <mjg59@srcf.ucam.org> wrote:
> > So why not add a mechanism to permit applications to indicate thatWell, http://www.stigviewer.com/check/V-29067 implies that filtering of
> > certain accesses they make should be ignored by audit?
> >
> Just so people know, this is like one of the the oldest auditing argument
> in the world. I have had programmers say that since the 1990's. [The
> standard counter story is that user program X says "don't audit anything I
> do in /etc." The programmer counters with adding in a black list of
> directories that can't be audited, this gets countered by something else
> and eventually you have a process where programs that have a GPG signature
> that has been accepted as valid by the audit program can say which of the
> white listed files it wants opened without audit are dealt with... and then
> some other programmer comes in and shows the 20,000 lines of need to be
> audited code replaces 40 lines of C code in the programs that were causing
> the problem.]
audit records is a reasonable thing to do. I have no expectation that
arbitrary user applications should be able to do whatever they want
without leaving an audit trail, but I don't see what that has to do with
system applications. Root has the ability to modify the selinux policy,
so root (and packages installed by root) should have the ability to
modify the set of behaviours that trigger audit records.