From mboxrd@z Thu Jan 1 00:00:00 1970 From: hsultan@thefroid.net Subject: ABI guarantee for auditd Date: Thu, 15 Jan 2015 12:24:38 -0800 Message-ID: <3fbf5caa9cacbccadda7623eabadbc05@thefroid.net> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; Format="flowed" Content-Transfer-Encoding: 7bit Return-path: Received: from mx1.redhat.com (ext-mx12.extmail.prod.ext.phx2.redhat.com [10.5.110.17]) by int-mx11.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id t0FKOdIQ024193 for ; Thu, 15 Jan 2015 15:24:39 -0500 Received: from homiemail-a68.g.dreamhost.com (sub5.mail.dreamhost.com [208.113.200.129]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id t0FKOc0T031159 for ; Thu, 15 Jan 2015 15:24:39 -0500 Received: from homiemail-a68.g.dreamhost.com (localhost [127.0.0.1]) by homiemail-a68.g.dreamhost.com (Postfix) with ESMTP id 7290140113760 for ; Thu, 15 Jan 2015 12:24:38 -0800 (PST) Received: from webmail.thefroid.net (caiajhbihbdd.dreamhost.com [208.97.187.133]) (Authenticated sender: hsultan@thefroid.net) by homiemail-a68.g.dreamhost.com (Postfix) with ESMTPA id 6190340113756 for ; Thu, 15 Jan 2015 12:24:38 -0800 (PST) List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com Hi, Sorry for the deluge of questions :) Regarding auditd, what is the ABI guarantee ? Do you guarantee that the text contained in audit_reply->msg.data will always be the same format ? I imagine you reserve the right to add fields, but how about removing any or even reordering them ? Or are people simply required to use auparse to guarantee they get records properly ? Also, regarding 'unofficial' ABI compatibility, when has the audit_reply->msg.data format changed last ? Say these past 3-4 years, were there any changes in the format or could I use a faster, but specifically focused parser on the msgs when detecting older releases at least ? Thanks, Hassan