Re: Performance of libauparse

On Wednesday 01 October 2008 9:15:27 am Eric Paris wrote: > On Tue, 2008-09-30 at 15:18 -0400, John Dennis wrote: > > Eric likes to point out we can't change the > > kernel > > Close, but not quite. I say we can't change the kernel without > complete backwards compatibility. Show me the right solution and we > can get there, we just can't throw away what's already there. Not really aimed at anyone in particular, just throwing out a possible solution ... 1. By default kernel starts up and emits existing string format, legacy audit daemons function normally 2. If a new audit daemon starts it sends a message to the kernel indicating that it can handle the new format and the kernel starts emitting newly formatted records[1] 3. The new audit daemon records the audit records in whatever format it is configured to so: legacy string format, raw binary format, and/or some wacky format yet to be invented[2] [1] The new record format should probably a binary format which makes use of netlink attributes, this would avoid much of the string parsing and versioning problems we have seen previously. There is ample evidence of kernel subsystems using netlink in a similar fashion successfully. [2] If done carefully, we might be able to allow administrators to create their own on-disk string formats without the need to write an entire dispatcher plug-in.