is this message necessary?

Steve Grubb sgrubb at redhat.com
Thu Nov 10 00:01:43 UTC 2005


On Wednesday 09 November 2005 18:15, Linda Knippers wrote:
> I just noticed the message is similarly vague when system call
> rules are removed.  It just says "removed an audit rule".

So, who wants to update this? I agree that we could at least put the list name 
& syscall number(s) into it or "all" if that applies. There's no way the 
kernel should do the whole thing since that duplicates userspace. Just the 
syscall & list name would be enough to guess the rule in most cases.

-Steve




More information about the Linux-audit mailing list