Re: [PATCH V3] audit: normalize NETFILTER_PKT
Richard Guy Briggs <rgb(a)redhat.com> wrote:
> Perhaps I'm missing something here, but let me ask again,
how does
> userspace distinguish between an unset nfmark and a nfmark of
> 0xffffffff?
It can't.
It can if you log it as 0, as I asked in patch 1 review.
(You wouldn't log sk uid of 0 as -1 either, would you?)