Re: audit_receive_skb
On Monday 12 September 2005 13:28, Chris Wright wrote:
In aduit_receive_skb (just basic sanity checks on skb length and
netlink
msg header info).
OK, I see.
> > It's void upstream, btw.
>
> If something can go wrong, we should detect the problem and return 1. If
> there is nothing that can go wrong, we should make it void. I guess
> that's what I'm getting at.
Going wrong == packet we can't handle. So we just drop it.
Does this send a NACK back to auditctl?
I agree, and it's already done upstream, but I don't think
it's worth
spinning a new kernel for.
I think we are at the point where we are starting the new development. Maybe
this doesn't go into a .89 kernel, but a .1 kernel for the new development
cycle.
Thanks,
-Steve