[RFC PATCH 2/2] [WIP] audit: allow other filter list types for AUDIT_DIR

Paul Moore paul at paul-moore.com
Mon Jun 4 22:12:31 UTC 2018


On Fri, Jun 1, 2018 at 4:12 AM, Ondrej Mosnacek <omosnace at redhat.com> wrote:
> I'm actually playing with the idea of unifying the filtering logic in
> these two functions, where sharing this function wouldn't be
> necessary. However, that is quite a big change (a lot of LOC being
> moved around) so I'd prefer the simple & dirty approach now and keep
> the cleanup for a later patch.

[Resend as I forgot the reply-all - oops]

I've had similar thoughts in the past, and deferred the work for
exactly the same reason.

If I recall correctly, I believe part of the reason may stem from the
fact that some fields are simply not always valid when the filter is
run and this may have been a crude effort at optimization (smaller
function size).  Regardless, we might preserve some of this idea by
creating some helper functions (two?) with the different filter fields
in each (no overlap) and a couple of wrapper functions which call the
appropriate helpers ... or that just might be extra work for no noticeable
perf advantage :)

-- 
paul moore
www.paul-moore.com




More information about the Linux-audit mailing list