Steve Grubb wrote: > On Friday 27 February 2009 11:56:57 am Linda Knippers wrote: >>> Let's discuss... >> Without "entry", does "exit" still make sense? > > You mean the name? I think so for a compatibility perspective.
If you're going to change things and go through a transition phase, you might as well change everything. > Not everyone > will change their rules right away. Are you suggesting to rename the exit > filter to something more generic? I'm suggesting changing the name to something that makes a little more sense, or doing away with it if it isn't necessary for syscalls anymore. I'm assuming that's the case because there's no need to distinguish it from "entry", so could we just drop "exit" and ignore it (silently or otherwise) in the transition? > >> In other words, are the choices really just "always" and "never"? > > For syscall, yes. There are still task, exclude, and user filters. Of these, > I > can't think of any use for the task filter anymore either. I think at one > time it, too, was envisioned to help select the right tasks for auditing. > > >> If we're going to change things, is this an opportunity to simplify in >> general? > > I wouldn't mind losing task filter, too. But I was thinking mostly of the > case > where entry rules identify a syscal is auditable and then the exit filter is > 99% of the time walked in its entirety before deciding nothing to do. Ok - still makes me think we could drop both "entry" and "exit" and just have "always" and "never". -- ljk > > -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
