Re: key in syscall audit rules.
On Tue, 2005-05-17 at 13:49 -0400, Steve Grubb wrote:
General comment, should you use uint32_t or __u32 ?
uint32_t is the C99 standard type.
I looked through the patch. I see what you are doing, but its not
quite the
same as we have in file system audit. The key is a text string that that gets
printed when an audit event gets logged.
That would be hard to introduce into audit rules without breaking binary
compatibility. The way it's done, you have 4 milliard possible keys for
syscall auditing rules. Do you really think that's insufficient?
--
dwmw2