On Wednesday 07 May 2008 13:20:42 Stephen Smalley wrote: > then we'd need to define two new fields, one to correspond > to the real/raw context string corresponding to the scontext and one to > correspond to the real/raw context string corresponding to the tcontext. > And they would only be present if the scontext and/or tcontext happened > to be invalid under current policy. Maybe "rscontext" and "rtcontext" > if we don't think that will confuse existing userspace
Sounds good to me. I don't think either names you mentioned are taken. -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
