From: Lenny Bruzenak <lenny@magitekltd.com>
To: linux-audit@redhat.com
Subject: Re: [PATCH] audit: set context->dummy even when audit is off
Date: Fri, 1 Nov 2019 09:26:41 -0500 [thread overview]
Message-ID: <f54be09d-297b-108a-533e-324a04fd1f6d@magitekltd.com> (raw)
In-Reply-To: <3063279.ZKBa9cPvsK@x2>
On 11/1/19 9:16 AM, Steve Grubb wrote:
> This is the root of the problem. Journald should never turn on audit since it
> has no idea if auditd even has rules to load. What if the end user does not
> want auditing? By blindly enabling audit without knowing if its wanted, it
> causes a system performance hit even with no rules loaded. It would be best
> if journald leaves audit alone. If it wants to listen on the multicast
> socket, so be it. It should just listen and not try to alter the system.
+1 for me, except I would also question why it would even listen, as to
me it seems that implies storage.
If that's true, I would want to be able to disable it as I do not want
audit events stored elsewhere as well.
Thx,
LCB
--
Lenny Bruzenak
MagitekLTD
next prev parent reply other threads:[~2019-11-01 14:26 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-09-23 15:50 ntp audit spew Dave Jones
2019-09-23 16:14 ` Paul Moore
2019-09-23 16:58 ` Dave Jones
2019-09-23 18:57 ` Paul Moore
2019-09-23 19:49 ` Dave Jones
2019-09-23 19:49 ` Eric Paris
2019-09-24 2:39 ` Paul Moore
2019-09-24 13:30 ` Steve Grubb
2019-09-23 21:00 ` Richard Guy Briggs
2019-09-24 3:01 ` Paul Moore
2019-09-24 13:50 ` Richard Guy Briggs
2019-09-24 17:05 ` Paul Moore
2019-09-26 15:50 ` Paul Moore
2019-09-24 13:19 ` Steve Grubb
2019-09-24 17:01 ` Paul Moore
2019-10-31 16:39 ` [PATCH] audit: set context->dummy even when audit is off Chris Mason
2019-10-31 16:39 ` Chris Mason
2019-10-31 23:27 ` Paul Moore
2019-11-01 13:24 ` Chris Mason
2019-11-01 14:16 ` Steve Grubb
2019-11-01 14:26 ` Lenny Bruzenak [this message]
2019-11-01 14:49 ` Steve Grubb
2019-11-01 14:58 ` Lenny Bruzenak
2019-11-01 15:55 ` Chris Mason
2019-11-05 0:15 ` Paul Moore
2019-11-05 0:39 ` Chris Mason
2019-11-05 0:45 ` Paul Moore
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=f54be09d-297b-108a-533e-324a04fd1f6d@magitekltd.com \
--to=lenny@magitekltd.com \
--cc=linux-audit@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.