audit by role testing
Steve Grubb
sgrubb at redhat.com
Tue Apr 4 20:42:33 UTC 2006
On Tuesday 04 April 2006 13:33, Darrel Goeddel wrote:
> The first patch (audit-1.1.5-audit_rule_data-support.patch) basically
> mirrors all calls that use an audit_rule struct with a similar call that
> uses an audit_rule_data struct. There are also a few bits that define
> things for nice compilation with the current headers. This patch should be
> completely backwards compatible since it only introduces new things (which
> are unused).
This was a big help. I'm merging most of this patch. This is along the lines
of what I had envisioned: parallel functions that augment (not replace)
current functions.
For auditctl, I'll just fix it to call the right function for the message
being sent. Meaning it will still favor the old functions except in
situations where it must use the new function.
Thanks,
-Steve
More information about the Linux-audit
mailing list