[RFC][PATCH] (#7U4) file system auditing by location and name

Steve Grubb sgrubb at redhat.com
Mon May 9 14:45:21 UTC 2005


On Monday 09 May 2005 10:35, Timothy R. Chavez wrote:
>Is that a fair analysis?

I guess. Is this good for you David?

>Admittedly, my approach was sloppier, and it appeared it wasn't 
>working for you

Did it work for you?

> Maybe we should be using unlikely() here?

Sure. The only other benefit that I could think of is that by deferring the 
allocation, it only occurs IFF the filesystem auditing is used. Anyone doing 
syscall only (or no auditing - just SE Linux avc denials) has a little bit of 
memory saved.

-Steve




More information about the Linux-audit mailing list