Getting the program name in audit messages

Stephen Smalley sds at tycho.nsa.gov
Fri Apr 1 19:24:00 UTC 2005


On Fri, 2005-04-01 at 14:25 -0500, Steve Grubb wrote:
> I think we're OK with this. Where does that leave the patch?

It just means that we keep the diff for auditsc.c as is, and drop the
diff for avc.c, i.e. we add comm and exe logging to the syscall auditing
but leave exe logging unmodified in the avc.  Which I think is what
David Woodhouse did already for his kernel since he wasn't sure about
the avc change.

-- 
Stephen Smalley <sds at tycho.nsa.gov>
National Security Agency




More information about the Linux-audit mailing list