[PATCH] (1/2) new audit filter allows excluding messages by type (kernel)

Steve Grubb sgrubb at redhat.com
Wed Nov 9 19:20:29 UTC 2005


On Wednesday 09 November 2005 10:43, Linda Knippers wrote:
> >>AUDIT_FILTER_USER is not syscall related and should not have been
> >>implemented as such.  Stuffing it in the syscall filtering code was
> >>lazy.
> >
> > I'm thinking that you are completely misunderstanding all of this.
>
> Maybe you could explain?

I'm completely misunderstanding Amy's mail. Sorry.

Dustin's patch is good and is a complete unit of work. Its job is not really 
to separate things that fall under the two kernel config options. A new patch 
that moves things around should be created and it should be discussed on a 
new thread.

-Steve




More information about the Linux-audit mailing list