Re: [RFC] Do away with entry filter
On Friday 27 February 2009 03:14:04 pm Eric Paris wrote:
> We still have user, task, and exclude filters. So we still need
to be
> able to specify them.
right, so lets call them user, task, exclude and SYSCALL rather than
user, task, exclude and EXIT.
Precisely what I was trying to get at with Linda's comments. We still have to
have the same rule format since you have to specify which filter the never or
always goes with. And I would have to honor entry/exit inside auditctl for
quite a while before dropping it there. But we should be careful about
changing defines in the kernel.
/me will very happily mark the old rule format, entry, and task
lists
for kernel removal. Maybe around 2.6.31? .32? I could clean all the
crap out.
Yes, I think we could give it a good cleaning out in the near future. I'd
prefer having a patch soonish, but not submitted for a while so that distros
can switch user space well before the kernel changes.
Additionally, I want to use the 2.0 release to clean out the legacy
workarounds for defines at various points in the audit system's life.
-Steve