tree 1f15c49cf4c9535bb3897d5fedbe78b3a7651410
parent a6c043a887a9db32a545539426ddfc8cc2c28f8f
author Steve Grubb <sgrubb@redhat.com> 1133617175 -0500
committer Al Viro <viro@zeniv.linux.org.uk> 1142881735 -0500

[PATCH] promiscuous mode

Hi,

When a network interface goes into promiscuous mode, its an important security
issue. The attached patch is intended to capture that action and send an
event to the audit system.

The patch carves out a new block of numbers for kernel detected anomalies.
These are events that may indicate suspicious activity. Other examples of
potential kernel anomalies would be: exceeding disk quota, rlimit violations,
changes to syscall entry table.

Signed-off-by: Steve Grubb <sgrubb@redhat.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>