Steve Grubb said the following on 2008-08-05 8:06: > On Saturday 02 August 2008 06:16:48 zhangxiliang wrote: >> When field is AUDIT_FILTERKEY, it should need a watch or syscall given >> prior to it. So I add checking and error message "-19" to realize it. >> >> Do you agree with me? > > Yes, but where does permadded get set?
"permadded" set in "lib/libaudit.c" as follows： int audit_permadded hidden = 0; int audit_archadded hidden = 0; int audit_syscalladded hidden = 0 It declares in "src/auditctl.c" as follows: extern int audit_permadded; > > Thanks, > -Steve > > > -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
