[RFC] Do away with entry filter
Eric Paris
eparis at redhat.com
Fri Feb 27 20:14:04 UTC 2009
On Fri, 2009-02-27 at 13:19 -0500, Steve Grubb wrote:
> On Friday 27 February 2009 12:48:30 pm Linda Knippers wrote:
> > I'm suggesting changing the name to something that makes a little
> > more sense, or doing away with it if it isn't necessary for syscalls
> > anymore. I'm assuming that's the case because there's no need to
> > distinguish it from "entry", so could we just drop "exit" and
> > ignore it (silently or otherwise) in the transition?
>
> We still have user, task, and exclude filters. So we still need to be able to
> specify them.
right, so lets call them user, task, exclude and SYSCALL rather than
user, task, exclude and EXIT.
/me will very happily mark the old rule format, entry, and task lists
for kernel removal. Maybe around 2.6.31? .32? I could clean all the
crap out.
-Eric
More information about the Linux-audit
mailing list