Re: Getting the program name in audit messages
On Fri, 2005-04-01 at 14:25 -0500, Steve Grubb wrote:
I think we're OK with this. Where does that leave the patch?
It just means that we keep the diff for auditsc.c as is, and drop the
diff for avc.c, i.e. we add comm and exe logging to the syscall auditing
but leave exe logging unmodified in the avc. Which I think is what
David Woodhouse did already for his kernel since he wasn't sure about
the avc change.
--
Stephen Smalley <sds(a)tycho.nsa.gov>
National Security Agency