/etc/security/audit_warn -- where to log to by default?

[fergus]

On 26.01-13:07, Adam C. Migus wrote:
[ ... ] 
> How about 1 syslogd process reading from multiple devices each with the 
> appropriate label implemented as a common label-aware syslogd process 
> that demonstrates the ability to read from multiple devices, each with 
> it's own label but on the premis that before it reads the message from 
> device with label X it creates a child with label X which is capable of 
> processing the message(s) in question.

this would have to be done in the userland process as it would
be difficult to have the kernel monitor and manually switch
the label based on message being accessed.  and, if that were
possible i don't see that we'd need multiple devices.  if it
is a userland function then it would be no different than
giving the process the privilage to switch labels.

perhaps i'm mis-understanding the suggestion.

-- 
: fergus cameron                :   [ .]        cobbled    :
: ^^^^^^@cobbled.net            : [ ~][ ]             .net :

To Unsubscribe: send mail to majordomo at trustedbsd.org
with "unsubscribe trustedbsd-discuss" in the body of the message