On Thu, Sep 17, 2015 at 7:35 AM, Richard Guy Briggs <[email protected]> wrote: > On 15/09/16, Paul Moore wrote: >> Otherwise, I think adding a result/success field to the >> AUDIT_CONFIG_CHANGE record makes sense as long as it doesn't break >> Steve's parsing code (I don't think it will, although it may simply >> ignore it, which is okay). > > It is already there, but never used for anything but success. I'm > proposing to add code to actually report the failures too.
So it is, even better as there shouldn't be a userspace problem. -- paul moore www.paul-moore.com -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
