From: Steve Grubb <sgrubb@redhat.com>
To: linux-audit@redhat.com
Subject: Re: Do we need entry,always rules?
Date: Tue, 8 Nov 2011 17:18:59 -0500 [thread overview]
Message-ID: <201111081718.59465.sgrubb@redhat.com> (raw)
In-Reply-To: <1320788300.10093.42.camel@localhost>
On Tuesday, November 08, 2011 04:38:20 PM Eric Paris wrote:
> The kernel will take them, but I believe we decided to deprecate them.
> I can remove some 'dead' code from the kernel and just return -EINVAL if
> someone tries to set one. Anyone see a problem with that?
That was the plan. User space migrated to exit filter rules with the audit 2.0 release.
That release was over 2 years ago. I also think the example rules in the 1.7 series
was changed to the exit filter so that people don't start off with entry filter rules.
So, you can start the process of deprecating it. I don't know if you want to just pull
the filter out or warn for a while before pulling it out.
-Steve
prev parent reply other threads:[~2011-11-08 22:18 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-11-08 21:38 Do we need entry,always rules? Eric Paris
2011-11-08 22:18 ` Steve Grubb [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=201111081718.59465.sgrubb@redhat.com \
--to=sgrubb@redhat.com \
--cc=linux-audit@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox