[PATCH 2/4] Add the checking for field AUDIT_FILETYPE and AUDIT_PPID

Steve Grubb sgrubb at redhat.com
Mon Aug 4 23:50:51 UTC 2008


On Saturday 02 August 2008 06:09:15 zhangxiliang wrote:
> When field is AUDIT_FILETYPET and AUDIT_PPID, it can only used for
> AUDIT_FILTER_EXIT and AUDIT_FILTER_ENTRY. I think the fields shoud be check
> before send audit rule to kernel. I add checking and error message "-17" to
> realize it.

Applied. Thanks !

-Steve




More information about the Linux-audit mailing list