Re: key in syscall audit rules.
On Wednesday 18 May 2005 16:13, Klaus Weidner wrote:
<snip>
The filterkeys can change as a consequence of administrator actions.
If
you put the mapping in the audit file header, you'd need to start a new
log file after each rule change, and that would be a mess.
-Klaus
I'm not saying this is the right approach, but for something so minor, can't
we just wait for someone to bitch about it on LKML and make it an issue if
someone feels like its an issue? There's probably not going to ever been a
lot of string filter keys for syscalls and watches combined. And, this will
set back usability quite a bit... (meaning someone is going to have to invest
the time to do the translation to and from user space). Can we just keep
them as strings, optimize with caching, and put this as a "nice to have" for
some time down the road? Then again, I am hooking the file system, so being
considerate where possible would probably work to our advantage.
What I don't want to have happen is to switch to a number schema which would
require that Steve or some one has to invest any large amount of time in
developing some way of book keeping this translation table/list to get it to
behave like it currently does.
You can slap me now.
-tim