by During using BSM, I met a problem.
I willing to audit all users including root and not to audit at all
about user "foo". I set up audit_control and audit_user like
following.
1. audit_control
flags:lo,ad,-all,^-fc
2. audit_user
foo::all
When user logins as "foo", no audit happen. But, When he switchs to
root using "su", the problem happen. After he become root, BSM audit
occurs. I hope no audit happen even after "su".
So, I have some question.
1. What does "username" in audit_user file mean? audit ID or effective
user ID?
2. How can I solve this problem?
Hope advice.
Thanks in advance,
Chun-Mok Chung