[PATCH] (1/2) new audit filter allows excluding messages by type (kernel)

Steve Grubb sgrubb at redhat.com
Wed Nov 2 13:23:39 UTC 2005


On Tuesday 01 November 2005 17:53, Dustin Kirkland wrote:
> - Define a new function audit_filter_exclude() that takes a message type
> as input and examines all rules in the filter.  It returns '1' if the
> message is to be excluded, and '0' otherwise.

You should check that the list is empty and short circuit. This will be the 
case %99.99 of the time.

-Steve




More information about the Linux-audit mailing list