is this message necessary?
Steve Grubb
sgrubb at redhat.com
Thu Nov 10 00:01:43 UTC 2005
On Wednesday 09 November 2005 18:15, Linda Knippers wrote:
> I just noticed the message is similarly vague when system call
> rules are removed. It just says "removed an audit rule".
So, who wants to update this? I agree that we could at least put the list name
& syscall number(s) into it or "all" if that applies. There's no way the
kernel should do the whole thing since that duplicates userspace. Just the
syscall & list name would be enough to guess the rule in most cases.
-Steve
More information about the Linux-audit
mailing list