Tushar wrote: > What is meaning of set_xxx fields in struct dazuko_accee ? > I have seen it almost for all fields of dazuko_access, e.g there is a > field "event" and "set_event", "filename" and "filename_set" etc.
Hi, It is not possible that all information is filled in with each event. For example, there is no "mode" for ON_CLOSE events. This value only makes sense for ON_OPEN events. Since there is no guarenteed way to represent an unset value, each value has a separate set_xxx boolean. If the boolean is set to false, then Dazuko was not able to determine a value for that item. For example, if uid == 0 and set_uid != 0, then you know that the event was triggered by a root process. But if uid == 0 and set_uid == 0, then this means that Dazuko was unable to determine which user triggered the event. In summary, the field XXX only has meaning if set_XXX is nonzero. John -- Dazuko Maintainer _______________________________________________ Dazuko-devel mailing list [email protected] http://lists.nongnu.org/mailman/listinfo/dazuko-devel
