On Thu, Jul 03, 2014 at 10:17:31AM +0200, Jakub Hrozek wrote:
On Wed, Jul 02, 2014 at 10:47:25AM +0200, Sumit Bose wrote:
> Explaining on the logs why access to a service was granted or denied is
> always a good idea. I guess those messages will fell in the
> audit-messages category but currently SSSD does not treat audit messages
> specially. Maybe we should start simple and just add an alias to the
> DEBUG macro called AUDIT? Later on we can start handling them differently
> than other debug messages but we will already have (at least for newer
> code) a label in the code where audit information originates.
I assume that 'later' would be in the context of
https://fedorahosted.org/sssd/ticket/2373 and similar tickets.
yes. I said 'later' because there might be quite a number of thing to
consider. E.g. we might want to support different audit
system/libraries; libaudit has different audit_log_* calls so we have to
decide which one to use in which case. Additionally we have to consider
how the SSSD audit messages relate to the audit messages which are
already send by the PAM stack.
Nevertheless I think it would be a good idea to start tagging messages
which we consider worth for audit in new code so that 'later' we can
just grep for the tag to see what type of messages we already have.
I wonder if we should add the audit messages more systematically than
only the GPO access provider, though..
sure that would be even better. I was just suggesting to start with new
code to not create additional work before we know if and to which level
we need to support audit in SSSD.
bye,
Sumit
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel