[patch] Syscall auditing - move "name=" field to the end

[Valdis.Kletnieks at vt.edu]

On Thu, 17 Mar 2005 14:00:03 EST, Steve Grubb said:

> Another way to do the same thing would be name=7:linux\n\0  This gets the 
> length in it without adding another field.

Consider:

name=7:f\007\007b

Is that "eff" "octal 7" "backslash zero zero seven bee", or
"eff backslash zero zero seven" "octal 7" "bee"?

We may have to bite the bullet and do a BSM-style binary format....
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 226 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20050317/4eea3c66/attachment.sig>