Re: [PATCH V3] audit: normalize NETFILTER_PKT

Paul Moore <paul(a)paul-moore.com&gt; wrote: > On Fri, Mar 3, 2017 at 7:45 AM, Florian Westphal <fw(a)strlen.de&gt; wrote: > > Richard Guy Briggs <rgb(a)redhat.com&gt; wrote: > >> > Perhaps I'm missing something here, but let me ask again, how does > >> > userspace distinguish between an unset nfmark and a nfmark of > >> > 0xffffffff? > >> > >> It can't. > > > > It can if you log it as 0, as I asked in patch 1 review. > > > > (You wouldn't log sk uid of 0 as -1 either, would you?) > > I want to see the code able to handle the full range of nfmark values > as well as the unset case; if that means we need to tweak userspace a > bit, please work with Steve on that. There is no 'unset nfmark'. Its just a 32bit integer.