Re: [Linux-ima-user] syslog and ima measurements

[Peter M. <pm...@go...>]

On Sat, Feb 11, 2012 at 4:05 PM, Mimi Zohar <zo...@li...> wrote:
> On Fri, 2012-02-10 at 10:02 -0800, Peter Moody wrote:
>> I'm probably missing something obvious, but I'm interested in getting
>> the contents of /sys/kernel/security/ima/ascii_runtime_measurements
>> into syslog. Is there an easy way to do this or do I have to write
>> something to do it manually?
>>
>> Cheers,
>> peter
>
> The measurements are currently only added to the measurement list.  With
> IMA-appraisal, invalid measurements are audited.

Is auditing the measurements something that you would consider
worthwhile or if I want to do this should I find some syslog-y way of
tailing the measurements file and sending them to syslog myself?

Cheers,
peter

> thanks,
>
> Mimi
>



-- 
Peter Moody      Google    1.650.253.7306
Security Engineer  pgp:0xC3410038