Re: [PATCH] (1/2) new audit filter allows excluding messages by type (kernel)

On Thu, 2005-11-03 at 14:20 -0500, Amy Griffis wrote: From include/linux/audit.h: #define AUDIT_FILTER_USER 0x00 /* Apply rule to user-generated messages */ #define AUDIT_FILTER_TASK 0x01 /* Apply rule at task creation (not syscall) */ #define AUDIT_FILTER_ENTRY 0x02 /* Apply rule at syscall entry */ #define AUDIT_FILTER_WATCH 0x03 /* Apply rule to file system watches */ #define AUDIT_FILTER_EXIT 0x04 /* Apply rule at syscall exit */ #define AUDIT_FILTER_EXCLUDE 0x05 /* Apply rule at audit_log_start */ So out of all of these, AUDIT_FILTER_ENTRY and AUDIT_FILTER_EXIT are the only two that are 'inherently syscall related', a minority in fact. If AUDIT_FILTER_EXCLUDE doesn't belong in auditsc.c, then neither does _USER, _TASK, _WATCH. I agree that these might be better placed elsewhere, but it's not the business of this patch to go about moving these things around. What are your thoughts on solving this properly for all filters? Note that this probably belongs in a thread of its own... Dustin