Hi Dave:
This wiki page may be of value:
http://wiki.freebsd.org/AddingAuditEvents
Robert N M Watson
Computer Laboratory
University of Cambridge
On Thu, 8 Nov 2012, dave jones wrote:
Hello,
I know how to create system calls, but I'm a bit confused about
sys/kern/syscalls.master file explained. For example, if I have a
foo system call, following code is added:
532 AUE_NULL STD { int foo(char *str); }
The question is in column two AUE_NULL, can I replace it with AUE_FOO?
How to determine the system call should be audit or not? Thank you.
Regards,
Dave.
_______________________________________________
freebsd-hackers@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-hackers
To unsubscribe, send any mail to "freebsd-hackers-unsubscr...@freebsd.org"
_______________________________________________
freebsd-hackers@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-hackers
To unsubscribe, send any mail to "freebsd-hackers-unsubscr...@freebsd.org"
