Re: [PATCH V3] audit: normalize NETFILTER_PKT
On Fri, Mar 3, 2017 at 7:45 AM, Florian Westphal <fw(a)strlen.de> wrote:
Richard Guy Briggs <rgb(a)redhat.com> wrote:
> > Perhaps I'm missing something here, but let me ask again, how does
> > userspace distinguish between an unset nfmark and a nfmark of
> > 0xffffffff?
>
> It can't.
It can if you log it as 0, as I asked in patch 1 review.
(You wouldn't log sk uid of 0 as -1 either, would you?)
I want to see the code able to handle the full range of nfmark values
as well as the unset case; if that means we need to tweak userspace a
bit, please work with Steve on that.
--
paul moore
www.paul-moore.com