[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: [PATCH] Audit filter rule operators (2/2)



On Mon, 2005-10-24 at 11:13 -0500, Timothy R. Chavez wrote:
> On Friday 21 October 2005 18:24, Dustin Kirkland wrote:
> > +		case AUDIT_EQUAL:
> > +		default:
> > +			rc = (left == right);
> > +			break;
> > +	}
> 
> Do we really want to default undefined operations to AUDIT_EQUAL.  I'd expect an error.

It's needed for backward compatibility, I think.  Older versions of
audit userspace will not have the notion of these new operators.  In
those cases, the "=" is implied, and negated by AUDIT_NEGATE.  Thus, I
think we need to assume that if none of the comparators are flagged,
then it's legacy audit userspace support, in which case we assume "=".

Is that unreasonable?

:-Dustin

Attachment: signature.asc
Description: This is a digitally signed message part


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]