Auditd initial commit
Initial commit for an audit daemon that writes kernel audit messages to a log file. The daemon runs in uid "audit" or AID_AUDIT. The log files are located at /data/misc/audit/ The daemon maintains two files at this location: audit.log and optionally audit.old. On boot ( if the file is non-zero in size), or when a fixed threshold is hit, the daemon rotates audit.log to audit.old. Optionally, if passed the -k option, the daemon polls dmesg for all lines that contain "audit" and writes them into the log. After that it continues to operate as normal, receiving the messages from the netlink socket. Change-Id: I5b5037a5a8b39a054213848249afb7808f8b0ffa
Loading
Please register or sign in to comment