Hi,
Some events, such as execve or socket-related syscalls generate more than
one message, which I'll separate as the "main" message, and then the 'sub'
messages.
Does the audit system guarantee in any way that user-mode will receive
either no message, or all messages for a given event ?
On Sat, Feb 21, 2015 at 10:00 AM, Davidlohr Bueso wrote:
> On Sat, 2015-02-21 at 08:45 -0500, Paul Moore wrote:
>> On Fri, Feb 20, 2015 at 8:23 PM, Davidlohr Bueso wrote:
>> > On Wed, 2015-02-18 at 22:23 -0500, Paul Moore wrote:
>> >> I'd prefer if the audit_log_d_path_exe() helper wasn't a stati
