[RFC][PATCH] audit: log join and part events to the read-only multicast log socket
Paul Moore
pmoore at redhat.com
Wed Oct 22 21:29:55 UTC 2014
On Wednesday, October 22, 2014 04:11:08 PM LC Bruzenak wrote:
> On 10/22/2014 03:44 PM, Paul Moore wrote:
> > We haven't changed anything yet, but I strongly believe we need to do away
> > with field ordering. The good news is that if you explicitly search for
> > the field instead of relying on a fixed order the code should be more
> > robust and work either way. ;)
>
> I have no doubt my old code looks like Steve's first example, not the
> second.
> But as I said, code can be changed if the assumptions about ordering are
> thrown out.
Well, like I said, It's probably safer that way as the code will work
regardless. Time to break bad habits :)
> You're making a pretty big splash over here Paul! Very impressive...
>
> :-)
Yeah "splash" ... it's been an interesting week.
--
paul moore
security and virtualization @ redhat
More information about the Linux-audit
mailing list