On Thu, Apr 7, 2016 at 12:47 AM, Deepika Sundar <[email protected]> wrote: > In the same way, in the kernel side > Can I able to add one new field to the audit log structure without breaking > Compatibility? If so, > 1.How can I add new field without breaking compatibility? > or > 2.Is there any reserve field in audit log structure so that I can make use > of it?
You need to be more specific about what you are trying to do. Speaking generally, unless you work to get your changed merged into the upstream kernel and userspace tools we cannot guarantee present or future compatibility. -- paul moore www.paul-moore.com -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
