Re: audit 0.9.12 released
On Friday 24 June 2005 09:34, David Woodhouse wrote:
Actually we need a 'yes/no/unmatched' answer.
I think unmatched means allow the message. I would err on the side of sending
messages and let the admin suppress them.
We could change it as you suggest, and if we do that we should
probably also
change audit_filter_rules() in the same fashion -- but let's not bother.
I think this one we leave alone. User message filtering is not related to
syscalls, so its different.
-Steve