[RFC][PATCH] audit: log join and part events to the read-only multicast log socket

Paul Moore pmoore at redhat.com
Wed Oct 22 21:29:55 UTC 2014


On Wednesday, October 22, 2014 04:11:08 PM LC Bruzenak wrote:
> On 10/22/2014 03:44 PM, Paul Moore wrote:
> > We haven't changed anything yet, but I strongly believe we need to do away
> > with field ordering.  The good news is that if you explicitly search for
> > the field instead of relying on a fixed order the code should be more
> > robust and work either way. ;)
> 
> I have no doubt my old code looks like Steve's first example, not the
> second.
> But as I said, code can be changed if the assumptions about ordering are
> thrown out.

Well, like I said, It's probably safer that way as the code will work 
regardless.  Time to break bad habits :)

> You're making a pretty big splash over here Paul! Very impressive...
> 
> :-)

Yeah "splash" ... it's been an interesting week.

-- 
paul moore
security and virtualization @ redhat




More information about the Linux-audit mailing list