<p> Thanks for your answer.</p>
<p> When selecting the audit syscall, are there some criterias? </p>
<p> It means that why some syscalls are audited but others are not audited.</p><br><br>
<div><span class="gmail_quote">On 11/7/05, <b class="gmail_sendername">Ilmar S. Habibulin</b> <<a href="mailto:ilmar@watson.org">ilmar@watson.org</a>> wrote:</span>
<blockquote class="gmail_quote" style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid"><br><br>On Fri, 4 Nov 2005, Yuan MailList wrote:<br><br>> 2. Why not audit syscall write(2)/writev/dup2 in trusted_audit3?
<br>> I think these syscalls are important for system security and should be<br>> audited. For security, the events of write and modify to files are more<br>> important than those of read to files. Is it right? :-)
<br><br>if you will simply audit write call, your trail will be trashed with such<br>entries. you need just open for writing audit entry, nothing more in<br>common situation. the only one reason to audit write calls is MAC, or even
<br>MAC debugging. Because labes of subjects and objects may change between<br>two write calls to the same fd. So audit records wiil help to track down<br>the problem.<br></blockquote></div><br>