[PATCH] IPC_SET_PERM cleanup
Klaus Weidner
klaus at atsec.com
Wed May 10 17:11:50 UTC 2006
On Wed, May 10, 2006 at 12:02:12PM -0500, Dustin Kirkland wrote:
> What about a new field in the audit records that is a bitmask, wherein
> bits are flipped on for each field being a "new" or "updated" field?
>
> Example:
>
> type=IPC_SET_PERM msg=audit(1146863632.117:98): new_qbytes=0 new_iuid=501
> new_igid=0 new_mode=0
>
> becomes:
>
> type=IPC_SET_PERM msg=audit(1146863632.117:98) new=1111: qbytes=0 iuid=501
> igid=0 mode=0
I'm not sure that's really necessary, the type=IPC_SET_PERM already tells
you that these are new values. How about simply the following:
type=IPC_SET_PERM msg=audit(1146863632.117:98): qbytes=0 iuid=501 igid=0 mode=0
-Klaus
More information about the Linux-audit
mailing list