Linux C2-Style Audit Capability

* frm [email protected] "08/04/01 09:24:11 +0000" | sed '1,$s/^/* /' *
*> System calls are overridden by pointing sys_call_table[system call] to a *> replacement function which saves off the data for auditing purposes, *> then calls the original system call.
*
* Ugly but that bit probably ties in with all the other folks trying to put
* together a unified security hook set for 2.5

Simply wrapping the system calls isn't going to get a CAPP (or C2) compliant audit implementation. It also isn't how the "unified security hooks" (aka LSM, Linux Security Modules) are working.

SGI is working towards a CAPP compliant audit implementation under the LSM framework, I'd suggest that you head over to http://lsm.immunix.org/ for more details on LSM.

richard.

-----------------------------------------------------------------------
Richard Offer Technical Lead, Trust Technology, SGI
"Specialization is for insects"
_______________________________________________________________________