[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: [patch] Syscall auditing - move "name=" field to the end



On Friday 18 March 2005 11:20, Timothy R. Chavez wrote:
> I'm going to hold off on the next auditfs patch to add this support into my
> code and use it for my name= and filterkey= fields so we can have some
> uniformity.

I can see why you need it for name, but I cannot see a reason for filterkey. 

I've tightened the communication between auditctl and the kernel in the 0.6.9 
release. In this way, I can better detect and handle errors with the kernel. 
I would think that you could scan filterkey when accepting the key and allow 
only alpha numeric characters, underscore, and dash. Anything else generates 
an EINVAL.

This would be less work for me to parse and faster for the kernel since it 
doesn't spend time encoding that field.

-Steve


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]