Eric Paris <[EMAIL PROTECTED]> writes: > So I'd say change all your stuff to look only at a0 for clone and > someone (sgrubb already knows) needs to fix auparse to look for the > flags in a0 not in a2.
This is very good news. I guess I was too trusting of the correctness of Steve's code. Thank you. John -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
