* Do we need entry,always rules?
@ 2011-11-08 21:38 Eric Paris
2011-11-08 22:18 ` Steve Grubb
0 siblings, 1 reply; 2+ messages in thread
From: Eric Paris @ 2011-11-08 21:38 UTC (permalink / raw)
To: linux-audit
The kernel will take them, but I believe we decided to deprecate them.
I can remove some 'dead' code from the kernel and just return -EINVAL if
someone tries to set one. Anyone see a problem with that?
-Eric
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: Do we need entry,always rules?
2011-11-08 21:38 Do we need entry,always rules? Eric Paris
@ 2011-11-08 22:18 ` Steve Grubb
0 siblings, 0 replies; 2+ messages in thread
From: Steve Grubb @ 2011-11-08 22:18 UTC (permalink / raw)
To: linux-audit
On Tuesday, November 08, 2011 04:38:20 PM Eric Paris wrote:
> The kernel will take them, but I believe we decided to deprecate them.
> I can remove some 'dead' code from the kernel and just return -EINVAL if
> someone tries to set one. Anyone see a problem with that?
That was the plan. User space migrated to exit filter rules with the audit 2.0 release.
That release was over 2 years ago. I also think the example rules in the 1.7 series
was changed to the exit filter so that people don't start off with entry filter rules.
So, you can start the process of deprecating it. I don't know if you want to just pull
the filter out or warn for a while before pulling it out.
-Steve
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2011-11-08 22:18 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-11-08 21:38 Do we need entry,always rules? Eric Paris
2011-11-08 22:18 ` Steve Grubb
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.