[PATCH] audit: use audit_log_task_info in audit_core_dumps and __audit_seccomp

Steve Grubb sgrubb at redhat.com
Tue Jan 14 14:48:36 UTC 2014


On Monday, January 13, 2014 09:56:35 PM Eric Paris wrote:
> It seems that reusing the task info pattern throughout records should
> allow for faster simpler more streamlined userspace records parsing, but
> changing order like this might be a deal breaker.

Have you tried using the ausearch test suite? I published it so that it can be 
found out what all these patches will do to the stability of user space. I'd 
delete your logs, reboot into test kernel, generate as many kind of events as 
possible, then extract the logs and test with the test suite.

-Steve




More information about the Linux-audit mailing list