watch structure

Steve Grubb sgrubb at redhat.com
Tue Apr 5 14:27:47 UTC 2005


On Tuesday 05 April 2005 09:16, Stephen Smalley wrote:
> The structure could just define the length and perms fields, then put a
> char buf[0]; at the end to allow referencing of watch->buf, and just
> include the two strings immediately after the structure when creating
> it

I can use this technique, too. I just want to make sure that 1) strings are 
sent into kernel inside netlink packet so there's no race. 2) When userspace 
receives a watch list, it comes in a format that needs no parsing.

-Steve




More information about the Linux-audit mailing list