Re: audit_receive_skb
* Steve Grubb (sgrubb(a)redhat.com) wrote:
On Monday 12 September 2005 12:36, Chris Wright wrote:
> That should just mean we're dropping bad packets.
Where would we detect the packet is bad?
In aduit_receive_skb (just basic sanity checks on skb length and netlink
msg header info).
> It's void upstream, btw.
If something can go wrong, we should detect the problem and return 1. If there
is nothing that can go wrong, we should make it void. I guess that's what I'm
getting at.
Going wrong == packet we can't handle. So we just drop it. I agree,
and it's already done upstream, but I don't think it's worth spinning
a new kernel for.