Re: [PATCH 1/2] audit: introduce a struct to represent an audit timestamp
On Mon, Dec 19, 2022 at 1:47 PM Casey Schaufler <casey(a)schaufler-ca.com> wrote:
On 12/19/2022 9:54 AM, Ondrej Mosnacek wrote:
> Join the two fields that comprise an audit timestamp into a common
> structure. This will be used further in later commits.
Patch 30/39 of my LSM stacking patchset[1] is almost identical to this.
The only significant difference is the structure name. You use audit_timestamp
whereas I use audit_stamp. I believe that audit_stamp is more correct and
more consistent with the code that uses it.
[1]
https://lore.kernel.org/lkml/f6b8ac05-6900-f57d-0daf-02d5ae53bc47@schaufl...
For the record, if "audit_stamp" and "audit_timestamp" are my only
two
options I prefer "audit_stamp" simply because it is shorter :)
That said, see my comments on patch 2/2. While an audit timestamp
struct improvement such as is proposed here and in the LSM stacking
patchset is fine, I'm not in favor of exposing the audit timestamp
outside the audit subsystem.
--
paul-moore.com