Re: [PATCH V1] audit: add warning that an old auditd may be starved out by a new auditd
On Thu, Sep 17, 2015 at 7:35 AM, Richard Guy Briggs <rgb(a)redhat.com> wrote:
On 15/09/16, Paul Moore wrote:
> Otherwise, I think adding a result/success field to the
> AUDIT_CONFIG_CHANGE record makes sense as long as it doesn't break
> Steve's parsing code (I don't think it will, although it may simply
> ignore it, which is okay).
It is already there, but never used for anything but success. I'm
proposing to add code to actually report the failures too.
So it is, even better as there shouldn't be a userspace problem.
--
paul moore
www.paul-moore.com