On Thursday, August 18, 2016 2:18:55 PM EDT Richard Guy Briggs wrote:
loginuid_set support should have been added to userspace when it was
added to the kernel around v3.10. Add it before we do similar for
sessionID and sessionID_set.
If this were accepted, how would this change writing rules? IOW, can you give
an example rule so we can see what this looks like?
Thanks,
-Steve
There will be a number of users of features_bitmap within the same
function (exclude filter extension, sessionID filter), so refactor
audit_rule_fieldpair_data() to put audit_get_features earlier in the
function.
Richard Guy Briggs (2):
get feature list only once
Add user filter option loginuid_set from uapi macro
AUDIT_LOGINUID_SET
trunk/lib/errormsg.h | 2 ++
trunk/lib/fieldtab.h | 2 ++
trunk/lib/libaudit.c | 17 ++++++++++++++++-
trunk/lib/libaudit.h | 6 ++++++
4 files changed, 26 insertions(+), 1 deletions(-)