Re: New field to auditd.conf file
As per my understanding audit log structure can be extendible based on
requirements and in my project I need to add the identifier field for the
application and as of now I couldn't able to revel the What application
trying to develop to update.So,Is there any possibility that without
breaking any Compatibility issues I can do it ? OR
If any compatibility issues please specify .
On Fri, Apr 8, 2016 at 12:12 AM, Paul Moore <paul(a)paul-moore.com> wrote:
On Thu, Apr 7, 2016 at 12:47 AM, Deepika Sundar
<sundar.deepika18(a)gmail.com> wrote:
> In the same way, in the kernel side
> Can I able to add one new field to the audit log structure without
breaking
> Compatibility? If so,
> 1.How can I add new field without breaking compatibility?
> or
> 2.Is there any reserve field in audit log structure so that I can make
use
> of it?
You need to be more specific about what you are trying to do.
Speaking generally, unless you work to get your changed merged into
the upstream kernel and userspace tools we cannot guarantee present or
future compatibility.
--
paul moore
www.paul-moore.com
Attachments:
- attachment.html (text/html — 1.7 KB)