[RFC][PATCH 9/11] security: AppArmor - Audit changes

Tony Jones tonyj at suse.de
Sat Apr 22 00:19:14 UTC 2006


On Fri, Apr 21, 2006 at 08:13:52PM -0400, Steve Grubb wrote:
> On Friday 21 April 2006 17:21, Amy Griffis wrote:
> > linux-audit (cc'd) will likely want to review these changes.
> 
> Yes, I second that. Tony, please cc audit patches to linux-audit mail list so 
> we can see them. That said, I did tell Tony they could use message type 
> numbers 1500 - 1600 for AppArmor if they need it.

Sorry, I thought I'd bounced this one patch in the series to the audit list.
I meant to. One more thing lost in the noise.  Apologies.

1500 should already be reserved for apparmor userside.  Only change is to 
enable it kernelside plus of course the one more symbol export to bloat the 
kernel image.  Export of the vformat call is to make it analagous to vprintk.  
Sometimes it's more convenient to have a single point of logging (as we do)
and you need to log data which is in va_list format.

Tony




More information about the Linux-audit mailing list