From mboxrd@z Thu Jan  1 00:00:00 1970
From: Paul Moore <pmoore@redhat.com>
Subject: Re: [RFC][PATCH] audit: log join and part events to the read-only
	multicast log socket
Date: Wed, 22 Oct 2014 17:29:55 -0400
Message-ID: <35356560.bDSLJB7XGk@sifl>
References: <30ef5c1ba42b52953e5684a0322975c3f0fadc77.1412706089.git.rgb@redhat.com>
	<2123008.Fh5Qt7eGrO@sifl> <54481D6C.9040809@magitekltd.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
In-Reply-To: <54481D6C.9040809@magitekltd.com>
List-Unsubscribe: <https://www.redhat.com/mailman/options/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: LC Bruzenak <lenny@magitekltd.com>
Cc: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

On Wednesday, October 22, 2014 04:11:08 PM LC Bruzenak wrote:
> On 10/22/2014 03:44 PM, Paul Moore wrote:
> > We haven't changed anything yet, but I strongly believe we need to do away
> > with field ordering.  The good news is that if you explicitly search for
> > the field instead of relying on a fixed order the code should be more
> > robust and work either way. ;)
> 
> I have no doubt my old code looks like Steve's first example, not the
> second.
> But as I said, code can be changed if the assumptions about ordering are
> thrown out.

Well, like I said, It's probably safer that way as the code will work 
regardless.  Time to break bad habits :)

> You're making a pretty big splash over here Paul! Very impressive...
> 
> :-)

Yeah "splash" ... it's been an interesting week.

-- 
paul moore
security and virtualization @ redhat