Re: logging securelevel violations

2002-03-16 Thread Robert Watson
On Sat, 16 Mar 2002, Rogier R. Mulhuijzen wrote: > At 09:23 16-3-2002 -0500, Robert Watson wrote: > > Second, these > >warnings would be generated during normal operations, as a number of > >applications attempt to load kernel modules when they need them, including > >ppp. Generating spurious

Re: logging securelevel violations

2002-03-16 Thread Rogier R. Mulhuijzen
At 09:23 16-3-2002 -0500, Robert Watson wrote: > Second, these >warnings would be generated during normal operations, as a number of >applications attempt to load kernel modules when they need them, including >ppp. Generating spurious warnings as part of normal system activity isn't >necessarily

Re: logging securelevel violations

2002-03-16 Thread Robert Watson
On Mon, 11 Mar 2002, Jeff Jirsa wrote: > I've noticed that currently, violations of securelevel are aborted, but not > typically logged. It seems like in addition to aborting whichever calls are > in progress, logging an error might be beneficial. I recognize that this > goes along the same line

Re: logging securelevel violations

2002-03-12 Thread Giorgos Keramidas
On 2002-03-12 22:26, Rogier R. Mulhuijzen wrote: > What I meant is, the file permissions on /dev/ad0 stop ordinary users from > even reaching the point where the secure level denies the attempt. > > And so only root can actually trigger the secure level violation log > message. So it cannot be

Re: logging securelevel violations

2002-03-12 Thread Rogier R. Mulhuijzen
At 16:07 12-3-2002 +0200, Giorgos Keramidas wrote: >On 2002-03-12 08:29, Rogier R. Mulhuijzen wrote: > > At 02:36 12-3-2002 +0200, Giorgos Keramidas wrote: > > >Rate limiting is still needed: > > > > > >while true ;do > > >echo "" > /dev/ad0 > > >echo "" > /

Re: logging securelevel violations

2002-03-12 Thread Giorgos Keramidas
On 2002-03-12 08:29, Rogier R. Mulhuijzen wrote: > At 02:36 12-3-2002 +0200, Giorgos Keramidas wrote: > >Rate limiting is still needed: > > > >while true ;do > >echo "" > /dev/ad0 > >echo "" > /dev/ad1 > >done > > > >This would cause syslogd to go nu

Re: logging securelevel violations

2002-03-11 Thread Rogier R. Mulhuijzen
At 02:36 12-3-2002 +0200, Giorgos Keramidas wrote: >On 2002-03-11 22:00, Rogier R. Mulhuijzen wrote: > > > > >I think this would be useful, but I would be concerned about the rate at > > >which these messages could come when someone is actively attacking a > > >system. > > >Perhaps such messages c

Re: logging securelevel violations

2002-03-11 Thread Giorgos Keramidas
On 2002-03-11 22:00, Rogier R. Mulhuijzen wrote: > > >I think this would be useful, but I would be concerned about the rate at > >which these messages could come when someone is actively attacking a > >system. > >Perhaps such messages could go through a rate limiter mechanism similar to > >that

RE: logging securelevel violations

2002-03-11 Thread Rogier R. Mulhuijzen
>I think this would be useful, but I would be concerned about the rate at >which these messages could come when someone is actively attacking a system. >Perhaps such messages could go through a rate limiter mechanism similar to >that now used by the network interfaces. syslogd already has a "las

RE: logging securelevel violations

2002-03-11 Thread Guy Helmer
Jeff Jirsa wrote: > I've noticed that currently, violations of securelevel are > aborted, but not > typically logged. It seems like in addition to aborting whichever > calls are > in progress, logging an error might be beneficial. I recognize that this > goes along the same lines as logging file p

logging securelevel violations

2002-03-11 Thread Jeff Jirsa
I've noticed that currently, violations of securelevel are aborted, but not typically logged. It seems like in addition to aborting whichever calls are in progress, logging an error might be beneficial. I recognize that this goes along the same lines as logging file permission errors, but if a fil