[RFC] Do away with entry filter
Steve Grubb
sgrubb at redhat.com
Fri Feb 27 21:18:40 UTC 2009
On Friday 27 February 2009 03:14:04 pm Eric Paris wrote:
> > We still have user, task, and exclude filters. So we still need to be
> > able to specify them.
>
> right, so lets call them user, task, exclude and SYSCALL rather than
> user, task, exclude and EXIT.
Precisely what I was trying to get at with Linda's comments. We still have to
have the same rule format since you have to specify which filter the never or
always goes with. And I would have to honor entry/exit inside auditctl for
quite a while before dropping it there. But we should be careful about
changing defines in the kernel.
> /me will very happily mark the old rule format, entry, and task lists
> for kernel removal. Maybe around 2.6.31? .32? I could clean all the
> crap out.
Yes, I think we could give it a good cleaning out in the near future. I'd
prefer having a patch soonish, but not submitted for a while so that distros
can switch user space well before the kernel changes.
Additionally, I want to use the 2.0 release to clean out the legacy
workarounds for defines at various points in the audit system's life.
-Steve
More information about the Linux-audit
mailing list