[PATCH 4/4] Add the checking of key field for a watch or syscall given
Steve Grubb
sgrubb at redhat.com
Tue Aug 5 01:59:00 UTC 2008
On Monday 04 August 2008 20:36:37 zhangxiliang wrote:
> >> When field is AUDIT_FILTERKEY, it should need a watch or syscall given
> >> prior to it. So I add checking and error message "-19" to realize it.
> >>
> >> Do you agree with me?
> >
> > Yes, but where does permadded get set?
>
> "permadded" set in "lib/libaudit.c" as follows:
> int audit_permadded hidden = 0;
> int audit_archadded hidden = 0;
> int audit_syscalladded hidden = 0
Right, but I don't see where it gets set to a 1.
Thanks,
-Steve
More information about the Linux-audit
mailing list