Checking for audit_enabled in the kernel

Steve Grubb sgrubb at redhat.com
Tue Nov 14 19:07:59 UTC 2006


On Tuesday 14 November 2006 14:01, Steve Grubb wrote:
> A good example of how to do this is in audit.h:

Actually, this is wrong - disregard. This would be modeled more like sending a 
user space rule into the kernel. In that case, audit_enabled is checked 
directly. Its already a public variable but just not in the audit.h file to 
prevent its proliferation. You can do this:

extern int audit_enabled;

in your file and use it.

-Steve




More information about the Linux-audit mailing list