[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

[PATCH 0/2] signal audit (v3)



Several changes since last version:
    - use arch rule field to determine which signal class to check,
      check both if arch is unspecified
    - don't check AUDIT_CLASS_SIGNAL_32 if it doesn't exist
    - group target pids in aux structs (initially 16)
    - on syscall exit, initialize context's aux ptrs for re-use
    - don't convert sid to string until we log a record

Applies on top of ptrace patch.


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]