On Tue, May 09, 2006 at 03:11:25PM -0400, Steve Grubb wrote: > Bottom line, for the search API, I want all similar types to have a common > field name. They can have a modifier adjacent to them.
If that's the way you want to do it, there needs to be a way to get the modifier to disambiguate them. Is adding "new " modifiers the best way to do that? You could also keep the field names the same and look at the syscall record type to find out which context they get used in. > On Tuesday 09 May 2006 14:27, Linda Knippers wrote: > >Maybe I should use a5, a6, ..., > Please no. Let's keep it as iuid or ouid. Naming them "a5" etc. would be terrible. The chown way of doing it wasn't intended as a role model, the point was just that since the information was present (even though obfuscated) there was no requirement to add special case logic to audit that call. A userspace reporting tool could fix this up if it wanted to. If you need new code to get the information, you may as well make it less obfuscated. > I'd personally prefer to drop iuid so we can consolidate field types. > ouid means "owner's uid". A consolidated field type "ouid" for the object owner makes sense (assuming that since the IPC records are changing anyway, we might as well make this additional change). This still leaves the independent problem that you have a single syscall which wants to report both the current ouid and the proposed new ouid it's trying to set it to. -Klaus -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
