Re: [RFC] Do away with entry filter

[Steve Grubb <sgrubb@redhat.com>]

On Friday 27 February 2009 03:14:04 pm Eric Paris wrote:
> > We still have user, task, and exclude filters. So we still need to be
> > able to specify them.
>
> right, so lets call them   user, task, exclude and SYSCALL rather than
> user, task, exclude and EXIT.

Precisely what I was trying to get at with Linda's comments. We still have to 
have the same rule format since you have to specify which filter the never or 
always goes with. And I would have to honor entry/exit inside auditctl for 
quite a while before dropping it there. But we should be careful about 
changing defines in the kernel.


> /me will very happily mark the old rule format, entry, and task lists
> for kernel removal.  Maybe around 2.6.31? .32? I could clean all the
> crap out.

Yes, I think we could give it a good cleaning out in the near future. I'd 
prefer having a patch soonish, but not submitted for a while so that distros 
can switch user space well before the kernel changes.

Additionally, I want to use the 2.0 release to clean out the legacy 
workarounds for defines at various points in the audit system's life.

-Steve