[RFC][PATCH] collect security labels on user processes generating audit messages

[Steve Grubb]

On Wednesday 15 February 2006 12:17, Linda Knippers wrote:
> How can I tell from the audit records that the file name was "(null)"
> vs. having "(null)" manufactured by the audit system?

ls -i "(null)"

and then compare inode values.

-Steve