<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>On 7/2/20 2:42 PM, Paul Moore wrote:<br>
</p>
<blockquote type="cite"
cite="mid:CAHC9VhTctHCCrm4Q1cPdFX-6NXEtmjEPmw6rvUoxOq8UUmycxA@mail.gmail.com">
<blockquote type="cite" style="font-size: large; color: #000000;">
<pre class="moz-quote-pre" wrap=""> #define AUDIT_FEATURE_BITMAP_BACKLOG_LIMIT 0x00000001
#define AUDIT_FEATURE_BITMAP_BACKLOG_WAIT_TIME 0x00000002
@@ -348,6 +349,7 @@ enum {
#define AUDIT_FEATURE_BITMAP_SESSIONID_FILTER 0x00000010
#define AUDIT_FEATURE_BITMAP_LOST_RESET 0x00000020
#define AUDIT_FEATURE_BITMAP_FILTER_FS 0x00000040
+#define AUDIT_FEATURE_BITMAP_BACKLOG_WAIT_SUM 0x00000080
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">In an effort not to exhaust the feature bitmap too quickly, I've been
restricting it to only those features that would cause breakage with
userspace. I haven't looked closely at Steve's userspace in quite a
while, but I'm guessing it can key off the structure size and doesn't
need this entry in the bitmap, right? Let me rephrase, if userspace
needs to key off anything, it <b class="moz-txt-star"><span class="moz-txt-tag">*</span>should<span class="moz-txt-tag">*</span></b> key off the structure size and
not a new flag in the bitmask <span class="moz-smiley-s3" title=";)"><span>;)</span></span>
Also, I'm assuming that older userspace doesn't blow-up if it sees the
larger structure size? That's even more important.
</pre>
</blockquote>
<p>Paul, <br>
</p>
<p>This change does seem to the untrained eye to be in line with the
existing FEATURE_BITMAP definitions. I appreciate your intent on
not exhausting the available space, but at some point if that
happens is there any reasonable way to expand? I'm sure you have
some thoughts, or is this "it" as far as features could go (the
last available bits)?<br>
</p>
<p>Max,</p>
<p>It's a pretty good feature. I agree with your original problem
assessment; this is an area I'm always looking at. I've got
questions I'll post separately as they are not germane to this
thread.</p>
<p><br>
</p>
<p>As an interested user I'm hoping for a resolution on this, so
that the userspace release can happen, as this seems to be a
beneficial change which I could make use of when available.<br>
</p>
<p><br>
</p>
<p>Thx,</p>
<p>LCB</p>
<br>
<pre class="moz-signature" cols="72">--
Lenny Bruzenak
MagitekLTD</pre>
</body>
</html>