Re: [PATCH] (1/2) new audit filter allows excluding messages by type (kernel)
On Wed, 2005-11-09 at 14:20 -0500, Steve Grubb wrote:
On Wednesday 09 November 2005 10:43, Linda Knippers wrote:
> >>AUDIT_FILTER_USER is not syscall related and should not have been
> >>implemented as such. Stuffing it in the syscall filtering code was
> >>lazy.
> >
> > I'm thinking that you are completely misunderstanding all of this.
>
> Maybe you could explain?
I'm completely misunderstanding Amy's mail. Sorry.
Dustin's patch is good and is a complete unit of work. Its job is not really
to separate things that fall under the two kernel config options. A new patch
that moves things around should be created and it should be discussed on a
new thread.
For the benefit of everyone else, we discussed this on the LSPP
conference call today and David will work on a patch that moves the
filtering functionality out of the syscall scope where belongs.
While I think we're in agreement that Amy is correct in asking that the
filters be moved elsewhere, that's not the business of the patch in the
current thread. It's duly noted and David will be working on it.
:-Dustin
Attachments:
- signature.asc (application/pgp-signature — 189 bytes)