[RFC] Virtual Key Fields

[Eric Paris]

On Mon, 2008-03-24 at 09:52 -0400, Steve Grubb wrote:
> On Monday 24 March 2008 09:42:14 Eric Paris wrote:
> > > Auditctl will also allow delete all rules matching a key. This will allow
> > > the admin or a program to delete a set of rules related to just a
> > > particular key and leave all other rules intact.
> >
> > How does this work?  This is a completely new concept and it seems like
> > it should be a second patch after you have multiple keys in to start
> > with.
> 
> This is all in user space so no kernel changes are needed.
> 
> 
> > auditctl -a exit,always -w /tmp/file1 -k file1 -k shared-key
> > auditctl -a exit,always -w /tmp/file2 -k file2 -k shared-key
> >
> > now if I say (and i'm just guessing your new syntax):
> >
> > auditctl -d -k shared-key
> 
> I was only going to change the '-D' option (delete all). Assuming this was 
> typed:

Ok, the fact that you only planned to do this with -D assuages all of my
fears.  Don't think it is strictly necessary in the first patch round,
but at least I'm not scared of it any more  :)

-Eric