On Fri, 2005-05-20 at 10:01 -0700, Chris Wright wrote:
> +struct audit_aux_data_avc {
I guess it's not really avc specific (although it's primary user).
You mean generalize the struct for possible re-use by other audit
helpers but keep the type value and function distinct?
audit_aux_data_path? Analogous to struct path in namei.c.
Won't this change the order quite a bit? And how do you
correlate path
vs. exe, etc.? Oh, I see, you're not using it for exe...
Could be an issue for syscalls that involve multiple files, e.g. rename.
We are at least still logging the last component name, device, and inode
number with the avc message, and only deferring logging of the full
pathname.
--
Stephen Smalley
National Security Agency