On Friday 27 February 2009 03:14:04 pm Eric Paris wrote: > > We still have user, task, and exclude filters. So we still need to be > > able to specify them. > > right, so lets call them user, task, exclude and SYSCALL rather than > user, task, exclude and EXIT.
Precisely what I was trying to get at with Linda's comments. We still have to have the same rule format since you have to specify which filter the never or always goes with. And I would have to honor entry/exit inside auditctl for quite a while before dropping it there. But we should be careful about changing defines in the kernel. > /me will very happily mark the old rule format, entry, and task lists > for kernel removal. Maybe around 2.6.31? .32? I could clean all the > crap out. Yes, I think we could give it a good cleaning out in the near future. I'd prefer having a patch soonish, but not submitted for a while so that distros can switch user space well before the kernel changes. Additionally, I want to use the 2.0 release to clean out the legacy workarounds for defines at various points in the audit system's life. -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
