From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: [PATCH] IPC_SET_PERM cleanup Date: Tue, 9 May 2006 11:55:34 -0400 Message-ID: <200605091155.34730.sgrubb@redhat.com> References: <445BB351.2040303@hp.com> <200605091121.21457.sgrubb@redhat.com> <4460B6A2.7060801@hp.com> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: <4460B6A2.7060801@hp.com> Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Linda Knippers Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Tuesday 09 May 2006 11:34, Linda Knippers wrote: > If someone is looking for the records for a particular uid, wouldn't > they expect to get the records generated by someone with that uid? Not necessarily. I would like to present all matches of uid and let them=20 decide what is relavent. > > I thought it was settled at that time. If this was brought up on the = LSPP > > telecon I missed it. > > It didn't seem setttled, although you were the last to reply. =A0I thin= k > the discussion on the LSPP list is what initiated the mail exchange. I even updated the audit parsing specs to include all keywords: http://people.redhat.com/sgrubb/audit/audit-parse.txt > At this point there are already a bunch of uid fields (auid, uid, euid, > suid, fsuid, iuid, ouid) in various audit records, and a similar set > of guid files, so would you be happier with nuid, ngid, etc? Does ouid and ogid not fit? I'd like us to define what we need in the par= ser=20 API and then use it in the audit messages. Ancilliary words like new, old= ,=20 last, first should not be tied with an underscore. If you find any, let m= e=20 know. -Steve