Re: audit 0.6.10 released
On Tuesday 05 April 2005 16:47, David Woodhouse wrote:
0x80000000 is a flag for '64-bit'
0x40000000 is a flag for 'little-endian'
How would people want this to work? Like Debbie suggested?
The lower 16 bits are the ELF machine type.
How do you get the ELF machine type?
This was discussed on the list between Chris and myself when the
patch was
sent for viewing.
I should have paid more attention. :)
> I also just noticed that success is now "yes" or
"no". It was 0 and 1
Unless I'm mistaken, there was no explicit report of 'success=' before;
this is new information.
Right. However, the word "success" is already a field that auditctl defines.
We don't want to confuse people.
Perhaps you're thinking of the AUDIT_SUCCESS filter, which should
still work
as expected?
I suppose it still works as expected, its just that you send a 0 or 1 in and
get a yes or no back now.
-Steve