Re: [RFC] Do away with entry filter

[Linda Knippers <linda.knippers@hp.com>]

Steve Grubb wrote:
> On Friday 27 February 2009 11:56:57 am Linda Knippers wrote:
>>> Let's discuss...
>> Without "entry", does "exit" still make sense?
> 
> You mean the name? I think so for a compatibility perspective. 

If you're going to change things and go through a transition
phase, you might as well change everything.

> Not everyone 
> will change their rules right away. Are you suggesting to rename the exit 
> filter to something more generic?

I'm suggesting changing the name to something that makes a little
more sense, or doing away with it if it isn't necessary for syscalls
anymore.  I'm assuming that's the case because there's no need to
distinguish it from "entry", so could we just drop "exit" and
ignore it (silently or otherwise) in the transition?

> 
>> In other words, are the choices really just "always" and "never"?
> 
> For syscall, yes. There are still task, exclude, and user filters. Of these, I 
> can't think of any use for the task filter anymore either. I think at one 
> time it, too, was envisioned to help select the right tasks for auditing. 
> 
> 
>> If we're going to change things, is this an opportunity to simplify in
>> general? 
> 
> I wouldn't mind losing task filter, too. But I was thinking mostly of the case 
> where entry rules identify a syscal is auditable and then the exit filter is 
> 99% of the time walked in its entirety before deciding nothing to do.

Ok - still makes me think we could drop both "entry" and "exit" and
just have "always" and "never".

-- ljk
> 
> -Steve