Erich Schubert wrote: > Hi, > > I'm not entirely sure which kernel config option this refers to, could > > you dig that up? That not withstanding, your suggestion seems fine to > > me, though I would appreciate some feedback from others. I've CCed > > Manoj in case he has some oppinions. > > CONFIG_AUDIT and CONFIG_AUDIT_SYSCALL. > IIRC the latter allows you to disable audit logging from userspace as > well as configure where the logs go to (e.g. via netlink to a userspace > audit daemon)
AFAIR CONFIG_AUDIT_SYSCALL was disabled because of its performance overhead and limited usefulness. The debian-kernel list archive should have some discussion about it. Thiemo -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
