Re: [RFC PATCH ghak90 (was ghak32) V3 02/10] audit: log container info of syscalls

> > + * audit_log_contid - report container info > > + * @tsk: task to be recorded > > + * @context: task or local context for record > > + * @op: contid string description > > + */ > > +int audit_log_contid(struct task_struct *tsk, > > + struct audit_context *context, char *op) > > +{ > > + struct audit_buffer *ab; > > + > > + if (!audit_contid_set(tsk)) > > + return 0; > > + /* Generate AUDIT_CONTAINER record with container ID */ > > + ab = audit_log_start(context, GFP_KERNEL, AUDIT_CONTAINER); > > + if (!ab) > > + return -ENOMEM; > > + audit_log_format(ab, "op=%s contid=%llu", > > + op, audit_get_contid(tsk)); > > Can you explain your reason for including an "op" field in this record > type? I've been looking at the rest of the patches in this patchset > and it seems to be used more as an indicator of the record's > generating context rather than any sort of audit container ID > operation. "action" might work, but that's netfilter and numeric... "kind"? Nothing else really seems to fit from a field name, type or lack of searchability perspective. Steve, do you have an opinion?