2 ms·
This seems like one of those things that should be possible to enable by recompiling the kernel, but disabled by default. Tradeoffs are abundant in software fea
by otterley 5y ago
This seems like one of those things that should be possible to enable by recompiling the kernel, but disabled by default. Tradeoffs are abundant in software features vs. performance, and this isn't really much different. The security-minded user can decide to take the performance hit if they really need to enable auditing. The key is to clearly document how to enable it and to set expectations regarding the performance impact.
- nieve 5y agoI believe audit is already optional at compile time. As the article points out audit being enabled is a requirement for some certifications, so what actually gets shipped by some distros is going to have it on regardless. If say RHEL and Ubuntu enable audit (I believe they do) declaring you've fixed the problems by making sure it's still optional isn't actually addressing it.