[patch] fix syscall speedup patch mips typo

Steve Grubb sgrubb at redhat.com
Wed Mar 15 17:09:55 UTC 2006


On Wednesday 15 March 2006 11:58, Linda Knippers wrote:
> I also get a message of type UNKNOWN, more AVCs with the
> same serial number and then the serial number increments and I get
> a bunch more stuff.  See below.  What's type 1310?

SYSCALL_PARTIAL. audit 1.1.5 knows what that is.

I'm seeing the something similar and was just talking with Jason about it. We 
are still mulling over what's really happening. Is it stacking contexts or 
something weird happening on output.

On my system, I had a hald avc message repeat 5 times. It was nothing to do 
with socketcall. The trick to recreating the problem seems to be not having 
audit rules loaded and letting normal system avcs do their thing.

-Steve




More information about the Linux-audit mailing list