On Tue, Mar 13, 2007 at 03:00:46PM -0400, Amy Griffis wrote: > > + if (sid) > > + selinux_sid_to_string(sid, &context->obj_ctx, &len); > > +} > > Why did you choose to do the sid to string conversion at collection > time, rather than waiting for audit_log_exit?
Narrower window for sid_to_context to change... -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
