Hi Steve,
I used your plugin code sample
-https://github.com/linux-audit/audit-userspace/blob/master/contrib/plugin/audisp-example.c
to handle audit messages when I write some audit rules. it works perfectly fine with some
minor tweaks
Now I want to extend the same plugin to filter AVC and USER_AVC messages and sent to our
system log. But while developing SELINUX policy there are too many of these and hence the
plugin is unable to handle it and system hangs. Is there a way to increase the capacity of
plugin to handle so many AVC denials. Eventually when the SELINUX policy is matured , I
expect to see a lot less of these denials.