[redhat-lspp] Re: adding session id information to audit records in RHEL5

[Paul Moore]

On Thursday 13 December 2007 1:50:59 pm Eric Paris wrote:
> My real question is not whether this is a good idea but more how are
> the certification tests going to react to having new information
> appear in the records?

I'm pretty sure it shouldn't affect our audit tests as they typically 
just involve running a regex over the audit record without regard to 
the actual field position within the record.  Personally I'd say add 
the new field wherever you see fit - I think relying on field position 
is bad practice and we shouldn't bend over backwards trying to 
accommodate those apps which are sensitive to field position.

-- 
paul moore
linux security @ hp