Re: [patch] Syscall auditing - move "name=" field to the end
On Friday 18 March 2005 11:20, Timothy R. Chavez wrote:
I'm going to hold off on the next auditfs patch to add this
support into my
code and use it for my name= and filterkey= fields so we can have some
uniformity.
I can see why you need it for name, but I cannot see a reason for filterkey.
I've tightened the communication between auditctl and the kernel in the 0.6.9
release. In this way, I can better detect and handle errors with the kernel.
I would think that you could scan filterkey when accepting the key and allow
only alpha numeric characters, underscore, and dash. Anything else generates
an EINVAL.
This would be less work for me to parse and faster for the kernel since it
doesn't spend time encoding that field.
-Steve