On Monday 04 August 2008 20:36:37 zhangxiliang wrote: > >> When field is AUDIT_FILTERKEY, it should need a watch or syscall given > >> prior to it. So I add checking and error message "-19" to realize it. > >> > >> Do you agree with me? > > > > Yes, but where does permadded get set? > > "permadded" set in "lib/libaudit.c" as follows： > int audit_permadded hidden = 0; > int audit_archadded hidden = 0; > int audit_syscalladded hidden = 0
Right, but I don't see where it gets set to a 1. Thanks, -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
