Re: auditd netlink headers
On Friday 29 April 2005 15:58, Chris Wright wrote:
You mean I'm looking at old code, or old code to handle this was
removed?
Old code was removed. I did not want the added complexity if it wasn't a
problem. The basic gist is you cannot use recvfrom to do it. You switch over
to recvmsg to do the job and loop. I think there are some other bits that I
didn't put there yet.
I just made a kernel module that does it (it requires a patch to
kernel
to export the needed symbols).
It takes an hour to compile a kernel. Its a friday afternoon.
-Steve