[PATCH] Add audit events

[Bill Nottingham]

Steve Grubb (sgrubb at redhat.com) said: 
> > It's still relatively easy to change runlevel, bypassing the audit logs,
> > by just using "initctl emit" instead of the compat tools.
> 
> Does initctl have any notion of a runlevel number? My main objective was to 
> cover all the places that utmp is written to. A secondary goal was to provide 
> runlevel transition information.

Not really, no. It's just an event that can be emitted like any other.

Bill