On Mon, Mar 08, 2004 at 05:30:06PM +0300, dlagno@mail.nnov.ru wrote:
> 
> veriexec generates messages of 2 types: about mismatched fingerprints and 
> about lacking fingerprint.  All of them go to syslog with high importance 
> level.

They are just kernel printf's so there is not much control about how
they are logged.

>  Only messages about mismatched fingerprints are really always 
> important.  Messages about lacking fingerprint may be not so interesting 
> but they also go as "kern.crit".  Those messages can junk up logs. 

No, I don't think you are correct on that.  Lacking a fingerprint
*should* not happen once the fingerprints have been loaded into the
kernel.  If you have securelevel at 3 then those executables would be
denied execution.  Lacking a fingerprint should be an indication that
someone is trying to run something that has not been made part of the
trusted computing base and as such the incident should be investigated
and acted on.

> Maybe 
> NetBSD need to have some sysctl variable to change their syslog level?  
> Or separate syslog facility.
> 

Or maybe a a sysctl variable to turn off the lack of a fingerprint?  I
am not sure that is the right thing to do though.

> Also note that MAKEDEV currently does not create /dev/veriexec.

I thought that had been fixed earlier this year.  How recent is your
-current?

-- 
Brett Lymn