[PATCH] (1/2) new audit filter allows excluding messages by type (kernel)
Steve Grubb
sgrubb at redhat.com
Wed Nov 2 13:23:39 UTC 2005
On Tuesday 01 November 2005 17:53, Dustin Kirkland wrote:
> - Define a new function audit_filter_exclude() that takes a message type
> as input and examines all rules in the filter. It returns '1' if the
> message is to be excluded, and '0' otherwise.
You should check that the list is empty and short circuit. This will be the
case %99.99 of the time.
-Steve
More information about the Linux-audit
mailing list