On 14/01/13, Eric Paris wrote:
> Further documentation of the 3 possible kernel value of the audit
> command line option.
>
> Signed-off-by: Eric Paris <[email protected]>
> ---
> Documentation/kernel-parameters.txt | 8 ++++++++
> 1 file changed, 8 insertions(+)
>
> diff --git a/Documentation/kernel-parameters.txt
> b/Documentation/kernel-parameters.txt
> index ab86766..5867442 100644
> --- a/Documentation/kernel-parameters.txt
> +++ b/Documentation/kernel-parameters.txt
> @@ -465,6 +465,14 @@ bytes respectively. Such letter suffixes can also be
> entirely omitted.
>
> audit= [KNL] Enable the audit sub-system
> Format: { "0" | "1" } (0 = disabled, 1 = enabled)
> + 0 - kernel audit is disabled and can not be enabled
> + until the next reboot
> + unset - kernel audit is partially enabled and will
> + be fully enabled by the userspace auditd
How about:
unset - kernel audit is initialized but disabled and
will
be fully enabled by the userspace auditd
> + 1 - kernel audit is partially enabled just like 'unset'
> + only at most audit_backlog_limit messages will be
> + retained in RAM and forwarded to userspace auditd
> + when it being.
It looks like this sentence finished a bit prematurely... How about
"...when available." or a rewrite:
1 - kernel audit is initialized and partially
enabled, storing at most audit_backlog_limit
messages in RAM until it is fully enabled by
the userspace auditd.
> Default: unset
>
> audit_backlog_limit= [KNL] Set the audit queue size limit.
- RGB
--
Richard Guy Briggs <[email protected]>
Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red
Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545
--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit
