Re: Linux Auditing patch and additional questions
On Friday 24 February 2006 17:58, Mauricio Lin wrote:
The system clock is registered on the entry point of syscall, right?
No, its only referenced at the point that the audit system decides it needs to
write an audit event. Look at the function audit_get_stamp(). Its called by
audit_log_start. You can look for its callers to see when this occurs.
After that if syscall is put in the waitqueue, nothing is registered
when
it is awaked again to use the processor. Am I right?
True. But you might want to trace the above code to see how it works.
-Steve