event auditing

[richard offer]

* frm arr at watson.org "08/03/01 15:57:59 -0400" | sed '1,$s/^/* /'
*
* 
* I've been really busy and unable to make progress on any audit work, so
* what I have so far, which I've mailed the url to multiple times, is at:
* 
*   http://www.watson.org/~arr/trustedbsd-audit/

That's a good piece of work.

Something to note is that LSPP has subtly different audit requirements than
B1. In particular it requires the ability to include or exclude events
based on 

    1) user identity
    2) subject label
    3) object label

The wording is ambiguous, but its been interpreted for us as requiring
pre-selection.

richard.


-----------------------------------------------------------------------
Richard Offer                     Technical Lead, Trust Technology, SGI
"Specialization is for insects"
_______________________________________________________________________


To Unsubscribe: send mail to majordomo at trustedbsd.org
with "unsubscribe trustedbsd-discuss" in the body of the message