On Sun, 2006-09-17 at 10:19 -0400, Steve Grubb wrote: Since we're already discussing changing the libselinux userspace avc API for logging, I guess just hold off on this patch for now. But here's the pitch: I think it's reasonable to expect that people are going to be calling the libaudit logging functions from within printf-style functions that take a format string and argument list. This is true of the current userspace avc logging callback, and the X server, where the logging functions look like ErrorF(fmt, ...). I think it's fairly common to have logging subsystems that behave like this. Currently, something like the following is required: va_list ap; char buf[MAX_AUDIT_MESSAGE_LENGTH]; va_start(ap, fmt); vsnprintf(buf, MAX_AUDIT_MESSAGE_LENGTH, fmt, ap); audit_log_user_avc_message(..., buf, ...); va_end(ap); Which could be reduced to (with the duplicate API): va_list ap; va_start(ap, fmt); audit_log_user_avc_message(..., fmt, ap, ...); va_end(ap); Which avoids the library call and doesn't care about the max_length constant. Not terribly much, but why not have a convenience function for it? -- Eamon Walsh <ewalsh(a)tycho.nsa.gov&gt; National Security Agency