audit_receive_skb

[Chris Wright]

* Steve Grubb (sgrubb at redhat.com) wrote:
> On Monday 12 September 2005 13:28, Chris Wright wrote:
> > Going wrong == packet we can't handle.  So we just drop it.  
> 
> Does this send a NACK back to auditctl?

No, it doesn't, but this is the case where the netlink message header
in the skb is so meaningless that we can glean nothing useful from it
(including say, serial number that we'd NACK).

> > I agree, and it's already done upstream, but I don't think it's worth
> > spinning a new kernel for.
> 
> I think we are at the point where we are starting the new development. Maybe 
> this doesn't go into a .89 kernel, but a .1 kernel for the new development 
> cycle.

Yeah, it should be in sync with upstream for the new development.

thanks,
-chris