Re: [PATCH]: revised make xfrm_audit_log more generic patch

> + audit_log_format(audit_buf, "%s: auid=%u", buf, auid); > > if (sid != 0 && > security_secid_to_secctx(sid, &secctx, &secctx_len) == 0) The operation in buf will not be parsed by the user space tools. Let's use "op=%s " where you have "%s: " above. Audit record fields are name=value and fields separated by spaces. "op" is what we are using in other places to mean operation. I know its a change from the records above, but we previously had some detail about what operation was being performed by the record type and this did not matter so much. Now that we only have one event type, the meaning of the event being recorded needs to be parsable and in a field. It also wouldn't hurt to change the text being sent to this function to have a hyphen instead of a space, so "SPD delete" becomes "SPD-delete". This keeps the parser happy. This patch otherwise looks good.