[RFC] Do away with entry filter

Eric Paris eparis at redhat.com
Fri Feb 27 20:14:04 UTC 2009


On Fri, 2009-02-27 at 13:19 -0500, Steve Grubb wrote:
> On Friday 27 February 2009 12:48:30 pm Linda Knippers wrote:
> > I'm suggesting changing the name to something that makes a little
> > more sense, or doing away with it if it isn't necessary for syscalls
> > anymore.  I'm assuming that's the case because there's no need to
> > distinguish it from "entry", so could we just drop "exit" and
> > ignore it (silently or otherwise) in the transition?
> 
> We still have user, task, and exclude filters. So we still need to be able to 
> specify them.

right, so lets call them   user, task, exclude and SYSCALL rather than
user, task, exclude and EXIT.

/me will very happily mark the old rule format, entry, and task lists
for kernel removal.  Maybe around 2.6.31? .32? I could clean all the
crap out.

-Eric




More information about the Linux-audit mailing list