[PATCH V3] audit: normalize NETFILTER_PKT

Florian Westphal fw at strlen.de
Fri Mar 3 12:45:26 UTC 2017


Richard Guy Briggs <rgb at redhat.com> wrote:
> > Perhaps I'm missing something here, but let me ask again, how does
> > userspace distinguish between an unset nfmark and a nfmark of
> > 0xffffffff?
> 
> It can't.

It can if you log it as 0, as I asked in patch 1 review.

(You wouldn't log sk uid of 0 as -1 either, would you?)




More information about the Linux-audit mailing list