[patch] Syscall auditing - move "name=" field to the end

Steve Grubb sgrubb at redhat.com
Thu Mar 17 19:16:47 UTC 2005


On Thursday 17 March 2005 14:10, Valdis.Kletnieks at vt.edu wrote:
> name=7:f\007\007b
>
> Is that "eff" "octal 7" "backslash zero zero seven bee", or
> "eff backslash zero zero seven" "octal 7" "bee"?

In this scheme, I don't think there would be any escaping. The next 7 bytes 
are what it is.

-Steve




More information about the Linux-audit mailing list