audit 0.6.10 released

[David Woodhouse]

On Tue, 2005-04-05 at 16:17 -0400, Steve Grubb wrote:
> David, how did you intend userspace to compute a correct value? For
> example, my 2 bit machine has arch=40000003.

0x80000000 is a flag for '64-bit'
0x40000000 is a flag for 'little-endian'

The lower 16 bits are the ELF machine type. 3 is presumably EM_386. This
was discussed on the list between Chris and myself when the patch was
sent for viewing.

> I also just noticed that success is now "yes" or "no". It was 0 and 1

Unless I'm mistaken, there was no explicit report of 'success=' before;
this is new information. Before, there was merely 'exit=', and we were
making unwarranted inferences from it -- some architectures explicitly
report success/failure in a condition code register rather than using
small negative numbers _only_ to indicate failure. Perhaps you're
thinking of the AUDIT_SUCCESS filter, which should still work as
expected?

-- 
dwmw2