From mboxrd@z Thu Jan  1 00:00:00 1970
From: Steve Grubb <sgrubb@redhat.com>
Subject: Re: [PATCH 1/2] add SIGNAL syscall class
Date: Wed, 14 Feb 2007 14:04:07 -0500
Message-ID: <200702141404.07353.sgrubb@redhat.com>
References: <20070214182431.GA17337@fc.hp.com>
Mime-Version: 1.0
Content-Type: text/plain;
  charset="utf-8"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
In-Reply-To: <20070214182431.GA17337@fc.hp.com>
Content-Disposition: inline
List-Unsubscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

On Wednesday 14 February 2007 13:24:31 Amy Griffis wrote:
> Add a syscall class for sending signals.

The intent of the syscall classes had been to make an update independent way 
of being able to specify audit rules for filesystem auditing where new 
syscalls could be added. I don't know if this grouping would be useful in 
practice. <shrug>

What I have been thinking about is a grouping for delete and close. That would 
align with requirements on security standards people have to meet.

-Steve