[patch] fix syscall speedup patch mips typo

Linda Knippers linda.knippers at hp.com
Wed Mar 15 19:43:39 UTC 2006


> Steve Grubb wrote:
> 
>> On Wednesday 15 March 2006 12:39, Linda Knippers wrote:
>>
>>> When is a SYSCALL_PARTIAL emitted, vs a SYSCALL?
>>
>> Whenever there are no audit rules loaded and an AVC message is
>> triggered. We just grab what's readily available which means we don't
>> have the arch, syscall, or args. Everything else should be there.

I also don't understand how this is related to improving performance
when there are no audit rules.  It seems like it doubles the cost of
an AVC message.

-- ljk




More information about the Linux-audit mailing list