TOMOYO
Discussion Forums: Open DiscussionSearch this forum: Thread Title:TOMOYO audit logs
Post a followup to message [#32887] RE: TOMOYO audit logs: |  |
TOMOYO
Discussion Forums: Open DiscussionSearch this forum: Thread Title:TOMOYO audit logs
Post a followup to message [#32887] RE: TOMOYO audit logs: | |
![RSS feed of this forum [RSS]](http://static.sourceforge.jp/ic/feed-14x14.png "RSS feed for this forum"){kind=small}
RSS for this Forum
[#32878] TOMOYO audit logs
Subject:[#32887] RE: TOMOYO audit logs
Date:2007-10-22 09:29By:Tetsuo Handa (kumaneko)Thank you for your opinion.
Starting /usr/lib/ccs/ccs-auditd at /sbin/ccs-init would be possible
if /var/ partition is mounted read-write and /usr/ partition is mounted read-only,
but these partitions have to be mounted read-only at that moment
because fsck is called at /etc/rc.d/rc.sysinit .
TOMOYO can hold access logs up to MAX_GRANT_LOG and MAX_REJECT_LOG entries
in the kernel memory so that access logs won't be lost
when these partitions are not ready to write.