audit function doc. question

Timothy R. Chavez tinytim at us.ibm.com
Thu Jul 7 14:58:09 UTC 2005


On Wednesday 06 July 2005 17:58, randy_dunlap wrote:
> On Wed, 6 Jul 2005 15:21:15 -0700 Chris Wright wrote:
> 
> | * randy_dunlap (rdunlap at xenotime.net) wrote:
> | > kernel/audit.c (2.6.13-rc1-git5) audit_log_start() says:
> | > 
> | > /* Obtain an audit buffer.  This routine does locking to obtain the
> | >  * audit buffer, but then no locking is required for calls to
> | >  * audit_log_*format.  If the tsk is a task that is currently in a
> | >  * syscall, then the syscall is marked as auditable and an audit record
> | >  * will be written at syscall exit.  If there is no associated task, tsk
> | >  * should be NULL. */
> | > struct audit_buffer *audit_log_start(struct audit_context *ctx, int type)
> | > {
> | > 
> | > What does <tsk> refer to in the function description?
> | > There is no <tsk> in this function.
> | 
> | It refers to tsk, tsk, stale comment.  It's task->audit_context (which is
> | ctx there).  Interested in preparing a patch, could even move to proper
> | kerneldoc format ;-)
> 
> Yes, that's why I asked, I'm adding kerneldoc format comments
> to audit*.c (2 files).  You'll see it soon.

Yep.  I appreciate this as well.

> 
> ---
> ~Randy
> 
> --
> Linux-audit mailing list
> Linux-audit at redhat.com
> http://www.redhat.com/mailman/listinfo/linux-audit
> 
> 




More information about the Linux-audit mailing list