[PATCH] (1/2) new audit filter allows excluding messages by type (kernel)

[Dustin Kirkland]

On Wed, 2005-11-09 at 14:20 -0500, Steve Grubb wrote:
> On Wednesday 09 November 2005 10:43, Linda Knippers wrote:
> > >>AUDIT_FILTER_USER is not syscall related and should not have been
> > >>implemented as such.  Stuffing it in the syscall filtering code was
> > >>lazy.
> > >
> > > I'm thinking that you are completely misunderstanding all of this.
> >
> > Maybe you could explain?
> 
> I'm completely misunderstanding Amy's mail. Sorry.
> 
> Dustin's patch is good and is a complete unit of work. Its job is not really 
> to separate things that fall under the two kernel config options. A new patch 
> that moves things around should be created and it should be discussed on a 
> new thread.

For the benefit of everyone else, we discussed this on the LSPP
conference call today and David will work on a patch that moves the
filtering functionality out of the syscall scope where belongs.

While I think we're in agreement that Amy is correct in asking that the
filters be moved elsewhere, that's not the business of the patch in the
current thread.  It's duly noted and David will be working on it.

:-Dustin
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20051109/7fbc49ce/attachment.sig>