Re: [PATCH] cleanup audit name handling
On Tue, Nov 29, 2005 at 06:19:48PM -0500, Linda Knippers wrote:
In the case of an audit record, wouldn't it be important to
distinguish between a file name of "(null)" and a null file name?
I'd say so.
In the patch, I omitted the "name" field in the record when there is
no associated name.
I'm not sure how we get a null file name but if we can get a
null
file name, I think the audit record should be accurate.
Syscalls like fchmod and fchown have no assocated name because there
is no path_lookup().
Amy, how did you notice this?
Just code review.
Steve Grubb wrote:
> Not sure this is better. This patch causes the output to end
with
> =. Which makes people think that the software malfunctioned on
> output.
This is in the debug output, which should only be seen by developers.
I doubt this would be too confusing to a dev, but I'm not set on it.
The audit record is what I'm concerned about.
Amy