key in syscall audit rules.

[Steve Grubb]

On Tuesday 17 May 2005 16:38, David Woodhouse wrote:
> That would be hard to introduce into audit rules without breaking binary
> compatibility. 

Could the string go at the end? Then based on nlmsg_len, either have the old 
behavior or the new.

> The way it's done, you have 4 milliard possible keys for 
> syscall auditing rules. Do you really think that's insufficient?

Its not that its insufficient - its not the same. The patch uses a number 
while filesystem auditing is a text string. The idea is to provide a like 
feature regardless of what kind of audit rule.

-Steve