Re: [PATCH] cleanup audit name handling
In the case of an audit record, wouldn't it be important to
distinguish between a file name of "(null)" and a null file name?
I'm not sure how we get a null file name but if we can get a null
file name, I think the audit record should be accurate.
Amy, how did you notice this?
-- ljk
Steve Grubb wrote:
On Tuesday 29 November 2005 17:55, Amy Griffis wrote:
>Cleanup handling of name field: "(null)" is a legit filename, so don't
>use it for a placeholder.
Not sure this is better. This patch causes the output to end with =. Which
makes people think that the software malfunctioned on output. "(null)" is
supplied by printf and the like whenever it dereferences a NULL pointer...so
a precedent is already set for that string being output.
-Steve
--
Linux-audit mailing list
Linux-audit(a)redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit