tree b3e80a8147101db29dcc18596ea20b1fcbeef6ad
parent a17b4ad778e1857944f5a1df95fb7758cd5cc58d
author Steve Grubb <sgrubb redhat com> 1169235595 -0500
committer Al Viro <viro@zeniv.linux.org.uk> 1171765812 -0500

[PATCH] audit config lockdown

The following patch adds a new mode to the audit system. It uses the
audit_enabled config option to introduce the idea of audit enabled, but
configuration is immutable. Any attempt to change the configuration
while in this mode is audited. To change the audit rules, you'd need to
reboot the machine.

To use this option, you'd need a modified version of auditctl and use "-e 2".
This is intended to go at the end of the audit.rules file for people that
want an immutable configuration.

This patch also adds "res=" to a number of configuration commands that did not
have it before.

Signed-off-by: Steve Grubb <sgrubb@redhat.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>