Re: Should this be a dontaudit or an allow in targeted.

[Russell Coker <russell@xxxxxxxxxxxx>]

On Tuesday 01 November 2005 03:02, Stephen Smalley <sds@xxxxxxxxxxxxx> wrote:
> On a related note, it has been suggested (on lspp) that we might need
> dontaudit/auditallow rules based on MLS level.  Is that true, or can we
> just leverage the existing TE-based rules to control such auditing based
> on type (which typically gives us finer granularity anyway)?

It seems sensible to have audit controlled on the same basis as access.  So 
for any criteria on which access can be allowed/denied it should be possible 
to base audit decisions on the same criteria.

auditconstrain/mlsauditconstrain?

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with
the words "unsubscribe selinux" without quotes as the message.