AUDIT_NETFILTER_CFG event format

[Richard Guy Briggs]

On 2017-01-17 09:07, Steve Grubb wrote:
> Hell Richard,
> 
> While we're in the NETFILTER area, the CFG event is lacking some fields, too. 
> Its currently:
> 
> table,family,entries
> 
> its missing everything about *who* sent it:
> pid,uid,auid,ses,subj,exe,res
> 
> I'd suggest:
> 
> pid,uid,auid,ses,subj,table,family,entries,exe,res
> 
> to make it compatible with the majority of records.

Ok, I've created an issue to track this:
	https://github.com/linux-audit/audit-kernel/issues/35

> Incidentally, I created a 
> chart that shows how each record type is alike and different from every other 
> record. You might call it a record grammar tree:
> 
> http://people.redhat.com/sgrubb/audit/record-fields.html
> 
> I'd like to align as many events as possible to pid,uid,auid section of the 
> graph.
> 
> -Steve

- RGB

--
Richard Guy Briggs <rgb at redhat.com>
Kernel Security Engineering, Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635