On Saturday 02 August 2008 06:09:15 zhangxiliang wrote: > When field is AUDIT_FILETYPET and AUDIT_PPID, it can only used for > AUDIT_FILTER_EXIT and AUDIT_FILTER_ENTRY. I think the fields shoud be check > before send audit rule to kernel. I add checking and error message "-17" to > realize it.
Applied. Thanks ! -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
