PATH records show fcaps

Steve Grubb sgrubb at redhat.com
Mon Oct 20 22:52:40 UTC 2008


On Monday 20 October 2008 12:55:41 Eric Paris wrote:
> > Steve's suggestion of cap_prm and cap_inh are good for being shorter and
> > matching proc output.  But OTOH it's a bit confusing as at first I
> > thought these were the task's values.  Would it be too terse to just
> > use fP and fI?
>
> yes, too terse. How about cap_fP, cap_fI, cap_fVer, cap_fEffBit ?
>
> Based on your other comments I'm going to go add fVer and fEffBit.

We don't have any audit fields with mixed cases in the field name. Let's not 
start it so that searches stay simple.

Thanks,
-Steve




More information about the Linux-audit mailing list