[PATCH] cleanup audit name handling

Linda Knippers linda.knippers at hp.com
Tue Nov 29 23:19:48 UTC 2005


In the case of an audit record, wouldn't it be important to
distinguish between a file name of "(null)" and a null file name?
I'm not sure how we get a null file name but if we can get a null
file name, I think the audit record should be accurate.

Amy, how did you notice this?

-- ljk

Steve Grubb wrote:
> On Tuesday 29 November 2005 17:55, Amy Griffis wrote:
> 
>>Cleanup handling of name field: "(null)" is a legit filename, so don't
>>use it for a placeholder.
> 
> 
> Not sure this is better. This patch causes the output to end with =. Which 
> makes people think that the software malfunctioned on output. "(null)" is 
> supplied by printf and the like whenever it dereferences a NULL pointer...so 
> a precedent is already set for that string being output.
> 
> -Steve
> 
> --
> Linux-audit mailing list
> Linux-audit at redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit
> 




More information about the Linux-audit mailing list