[PATCH 4/4] Add the checking of key field for a watch or syscall given

[zhangxiliang]

Steve Grubb said the following on 2008-08-05 8:06:
> On Saturday 02 August 2008 06:16:48 zhangxiliang wrote:
>> When field is AUDIT_FILTERKEY, it should need a watch or syscall given
>> prior to it. So I add checking and error message "-19" to realize it.
>>
>> Do you agree with me?
> 
> Yes, but where does permadded get set?

"permadded" set in "lib/libaudit.c" as follows：
 int audit_permadded hidden = 0;
 int audit_archadded hidden = 0;
 int audit_syscalladded hidden = 0
  
 It declares in "src/auditctl.c" as follows:
 extern int audit_permadded;

> 
> Thanks,
> -Steve
> 
> 
>