Re: [PATCH][RFC] Light-weight Auditing Framework

[Rik Faith <faith@redhat.com>]

On Wed  3 Mar 2004 10:55:01 +0200, Muli Ben-Yehuda <mulix@mulix.org> wrote:
> I'd like to second the sentiment - for syscalltrack, we would love to
> have a framework that can be used for debugging system call events. 

I should clarify to avoid any confusion.  The audit framework I am
proposing does _not_ allow for generic hooking of system calls.

However, the ability to audit the call is generic in the sense that
another part of the kernel can request that an audit record be generated
for the current in-progress system call (or filtering can be used to
request that audit records be generated).  Although this should be
sufficient for SELinux and other security infrastructures, as well as
many non-security uses, it would only support a subset of what
syscalltrack can do currently (i.e., audit can provide information about
the syscall, but can't be used to change the behavior of the syscall).