Fwd: Re: Fw: Audit records for start/stop auditd

[David Woodhouse]

On Wed, 2005-04-06 at 10:09 -0400, Steve Grubb wrote:
> I put it at the end so apps that have already been compiled with the old  
> siginfo_t size won't break. The app is handed a pointer to the structure by 
> the kernel, so its not like userspace ever allocates the struct, it just 
> references the contents of it.

Stack unwinders need to step over it -- it can't grow either.

-- 
dwmw2