watch structure

Casey Schaufler casey at schaufler-ca.com
Tue Apr 5 15:00:44 UTC 2005


--- Stephen Smalley <sds at tycho.nsa.gov> wrote:

> > That would require two copyins, one to get the
> > lengths and another to get the "buf". Not that
> > that's necessarily a stopper, but I had assumed
> > the goal was a one-shot interface.
> 
> No, the whole thing is sent as a single buffer that
> is copied into the
> kernel once.

But you don't know how much to copy. If you
decide on a fixed amount you may as well use
the previously discussed structure.

> buf[0] at the end of a structure is
> common practice to
> reference data stuffed directly at the end of the
> structure.

Yup, and I'd have suggested it myself save for
the two copy problem.


Casey Schaufler
casey at schaufler-ca.com


		
__________________________________ 
Do you Yahoo!? 
Yahoo! Mail - Find what you need with new enhanced search. 
http://info.mail.yahoo.com/mail_250




More information about the Linux-audit mailing list