Add support for the session ID user filter by adding the field name "sessionid" using the kernel defined macro value AUDIT_SESSIONID. https://github.com/linux-audit/audit-kernel/issues/4 RFE: add a session ID filter to the kernel's user filter Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; --- trunk/lib/fieldtab.h | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/trunk/lib/fieldtab.h b/trunk/lib/fieldtab.h index bf48c95..88cf8ea 100644 --- a/trunk/lib/fieldtab.h +++ b/trunk/lib/fieldtab.h @@ -31,6 +31,7 @@ _S(AUDIT_SGID, "sgid" ) _S(AUDIT_FSGID, "fsgid" ) _S(AUDIT_LOGINUID, "auid" ) _S(AUDIT_LOGINUID, "loginuid" ) +_S(AUDIT_SESSIONID, "sessionid" ) _S(AUDIT_PERS, "pers" ) _S(AUDIT_ARCH, "arch" ) _S(AUDIT_MSGTYPE, "msgtype" ) -- 1.7.1