From mboxrd@z Thu Jan 1 00:00:00 1970 From: Amy Griffis Subject: Re: [PATCH] fix ppid bug in 2.6.18 kernel Date: Mon, 28 Aug 2006 16:51:27 -0400 Message-ID: <20060828205127.GA21519@fc.hp.com> References: <200608261406.21274.sgrubb@redhat.com> <20060828185916.GA16805@fc.hp.com> <200608281522.14477.sgrubb@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Return-path: Received: from mx1.redhat.com (mx1.redhat.com [172.16.48.31]) by int-mx1.corp.redhat.com (8.12.11.20060308/8.12.11) with ESMTP id k7SKphZe029923 for ; Mon, 28 Aug 2006 16:51:43 -0400 Received: from atlrel8.hp.com (atlrel8.hp.com [156.153.255.206]) by mx1.redhat.com (8.12.11.20060308/8.12.11) with ESMTP id k7SKpgPs029099 for ; Mon, 28 Aug 2006 16:51:42 -0400 Received: from smtp1.fc.hp.com (smtp1.fc.hp.com [15.15.136.127]) by atlrel8.hp.com (Postfix) with ESMTP id 07ED2351B5 for ; Mon, 28 Aug 2006 16:51:36 -0400 (EDT) Received: from ldl.fc.hp.com (linux-bugs.fc.hp.com [15.11.146.30]) by smtp1.fc.hp.com (Postfix) with ESMTP id CFC4D79412 for ; Mon, 28 Aug 2006 20:51:36 +0000 (UTC) Received: from localhost (ldl.lart [127.0.0.1]) by ldl.fc.hp.com (Postfix) with ESMTP id 963481344C7 for ; Mon, 28 Aug 2006 14:51:36 -0600 (MDT) Received: from ldl.fc.hp.com ([127.0.0.1]) by localhost (ldl [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 06820-10 for ; Mon, 28 Aug 2006 14:51:33 -0600 (MDT) Content-Disposition: inline In-Reply-To: <200608281522.14477.sgrubb@redhat.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com Steve Grubb wrote: [Mon Aug 28 2006, 03:22:14PM EDT] > On Monday 28 August 2006 14:59, Amy Griffis wrote: > > AUDIT_PPID was recently added, so shouldn't be supported for the > > legacy structure. > > There's no harm in adding it here. Lets old userspace work with new kernels. > > > Instead auditctl should use struct audit_rule_data for rules with > > AUDIT_PPID. > > The way that it currently works is that it uses the old structures until it > decides that it needs the new structures (key, watch, etc). It needs to do > this so that people can boot into old kernels and issue audit commands. FC5 > includes 2.6.16 kernel and I will be pushing the current audit userspace into > FC5 when we know that everything works fine for 2.6.18. So, FC5 will have > users with both kinds of kernels. > > I will be removing all the old audit_rule stuff soon so that auditctl uses > nothing but the new interface. Somewhere around 2.6.20, we should pull all > the old audit_rule struct stuff from the kernel, too. Okay, I'm glad to hear it. My concern was not to support the legacy structure indefinitely. > But in the mean time, we should support both equally when it makes sense. > > -Steve >