On 2018-06-01 12:55, Steve Grubb wrote: > On Thursday, May 31, 2018 6:21:20 PM EDT Richard Guy Briggs wrote: > > On 2018-05-31 17:29, Steve Grubb wrote: > > > On Thursday, May 31, 2018 4:23:09 PM EDT Richard Guy Briggs wrote: > > > > The AUDIT_FILTER_TYPE name is vague and misleading due to not > > > > describing > > > > where or when the filter is applied and obsolete due to its available > > > > filter fields having been expanded. > > > > > > > > Userspace has already renamed it from AUDIT_FILTER_TYPE to > > > > AUDIT_FILTER_EXCLUDE without checking if it already exists. > > > > > > Historically speaking, this is not why it is the way it is. But I think > > > it > > > doesn't mean that you cannot do something like this: > > > > > > #define AUDIT_FILTER_EXCLUDE AUDIT_FILTER_TYPE > > > > I was originally hoping to do that, but that then causes a build error > > on any previous version of audit userspace. > > I cannot reproduce this. What error did you get? What version of gcc?
I didn't even try to compile it since I'd predicted that there would be a symbol definition conflict. How did you not get a conflict with that definition also in the kernel header? > -Steve - RGB -- Richard Guy Briggs <r...@redhat.com> Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, Ottawa, Red Hat Canada IRC: rgb, SunRaycer Voice: +1.647.777.2635, Internal: (81) 32635 -- Linux-audit mailing list Linux-audit@redhat.com https://www.redhat.com/mailman/listinfo/linux-audit