Steve Grubb wrote:
> On Sat, 27 Sep 2014 10:02:44 +0900
> Tetsuo Handa <penguin-ker...@i-love.sakura.ne.jp> wrote:
>
> > May I continue proposing this functionality?
>
> From the audit perspective, sure. I think we were expecting a revised
> patch after the comments. Other groups may have different thoughts,
> though.
>
> -Steve
OK, thank you. Before posting a revised patch, can I hear answers about
specification questions listed below?
(Q1) Where can I find which bytes in $value need to be escaped when
emitting a record like name='$value' ? Is 0x20 in $value permitted?
(Q2) Does auxiliary record work with only type=SYSCALL case?
Regards.
--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit
