On Thu, 2008-05-15 at 09:59 -0400, Steve Grubb wrote:
> Either make the audit system cope with userspace parts coming
later, or if
> starting auditd first is really a hard requirement, implement that in a way
> that doesn't require mailing list reminders ?
I have it as low in init priority as I can get it. It even starts before
rsyslog. If a graphical boot does not honor the settings in the init scripts,
what am I supposed to do? Is there another directory that I need to drop a
file into that gets picked up by the boot sequence?
Out of interest, does that mean that unlocking an encrypted disk leaves
no audit trail ? That potentially happens before init starts...