From mboxrd@z Thu Jan  1 00:00:00 1970
From: Eric Paris <eparis@redhat.com>
Subject: Re: [RFC] Do away with entry filter
Date: Fri, 27 Feb 2009 15:14:04 -0500
Message-ID: <1235765644.3386.64.camel@localhost.localdomain>
References: <200902270954.12237.sgrubb@redhat.com>
	<200902271240.12137.sgrubb@redhat.com> <49A8276E.3050806@hp.com>
	<200902271319.06607.sgrubb@redhat.com>
Mime-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
In-Reply-To: <200902271319.06607.sgrubb@redhat.com>
List-Unsubscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: Steve Grubb <sgrubb@redhat.com>
Cc: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

On Fri, 2009-02-27 at 13:19 -0500, Steve Grubb wrote:
> On Friday 27 February 2009 12:48:30 pm Linda Knippers wrote:
> > I'm suggesting changing the name to something that makes a little
> > more sense, or doing away with it if it isn't necessary for syscalls
> > anymore.  I'm assuming that's the case because there's no need to
> > distinguish it from "entry", so could we just drop "exit" and
> > ignore it (silently or otherwise) in the transition?
> 
> We still have user, task, and exclude filters. So we still need to be able to 
> specify them.

right, so lets call them   user, task, exclude and SYSCALL rather than
user, task, exclude and EXIT.

/me will very happily mark the old rule format, entry, and task lists
for kernel removal.  Maybe around 2.6.31? .32? I could clean all the
crap out.

-Eric