Re: [PATCH] Audit filter rule operators (2/2)
On Mon, 2005-10-24 at 11:13 -0500, Timothy R. Chavez wrote:
On Friday 21 October 2005 18:24, Dustin Kirkland wrote:
> + case AUDIT_EQUAL:
> + default:
> + rc = (left == right);
> + break;
> + }
Do we really want to default undefined operations to AUDIT_EQUAL. I'd expect an
error.
It's needed for backward compatibility, I think. Older versions of
audit userspace will not have the notion of these new operators. In
those cases, the "=" is implied, and negated by AUDIT_NEGATE. Thus, I
think we need to assume that if none of the comparators are flagged,
then it's legacy audit userspace support, in which case we assume "=".
Is that unreasonable?
:-Dustin
Attachments:
- signature.asc (application/pgp-signature — 189 bytes)