On Mon, Mar 10, 2008 at 09:27:04AM -0400, Daniel J Walsh wrote:
setroubleshoot can be setup on a headless box to send email. And
there
is an interface (named pipe) to audit system where you can receive AVC
messages as they happen. Just look at the setroubleshoot code since it
is using this.
Ooooo. That sounds interesting. I'm all for not re-inventing the wheel. Thing
is, I looked at man sealert and I couldn't see how to do this. I am not much
of a hacker, so looking at the code would probably not help me too much.
Is there a configuration setting I can set somewhere?
Thanks
Mark