[PATCH 2/2] audit string fields interface + consumer

Serge E. Hallyn serue at us.ibm.com
Thu Jan 19 17:29:48 UTC 2006


Quoting Amy Griffis (amy.griffis at hp.com):
> On Wed, Jan 18, 2006 at 12:02:10PM -0600, Serge E. Hallyn wrote:
> > Quoting Timothy R. Chavez (tinytim at us.ibm.com):
> > > On Tue, 2006-01-17 at 17:19 -0500, Amy Griffis wrote:
...
> > > AUDIT_MAX_FIELDS defaults to 64, sizeof(audit_field) is 12-bytes...
> > > 768-bytes... 788-bytes per audit_krule?
> > 
> > Agree.
> 
> Sorry, I'm not following how the list_head applies to the fields[]
> array.

Hah, I guess that's bc it doesn't, unless you misread the patch.

So then it's down to 4 bytes savings per audit_watch.  This is still
worth considering, but making the audit_fields and audit_values arrays
dynamic is clearly going to be far more useful.

thanks,
-serge




More information about the Linux-audit mailing list