[PATCH] the exit field should not be used in entry list

Steve Grubb sgrubb at redhat.com
Mon Jul 28 15:33:02 UTC 2008


Hi,

On Sunday 27 July 2008 20:44:17 zhangxiliang wrote:
> The entry list is applied to match fields before excuting syscall. When
> matching, the exit code of syscall is unknown. So the exit field should not
> be used in entry list.

Looks good. Applied. I also checked the code in libaudit.c and fixed it to do 
the same thing. Thanks for the patch.

-Steve




More information about the Linux-audit mailing list