On 2017-01-17 10:42, Richard Guy Briggs wrote: > On 2017-01-17 09:07, Steve Grubb wrote: > > Hell Richard, > > > > While we're in the NETFILTER area, the CFG event is lacking some fields, > > too. > > Its currently: > > > > table,family,entries > > > > its missing everything about *who* sent it: > > pid,uid,auid,ses,subj,exe,res > > > > I'd suggest: > > > > pid,uid,auid,ses,subj,table,family,entries,exe,res > > > > to make it compatible with the majority of records. > > Ok, I've created an issue to track this: > https://github.com/linux-audit/audit-kernel/issues/35
And I've just closed it since the associated SYSCALL setsockopt record lists all that information. > > Incidentally, I created a > > chart that shows how each record type is alike and different from every > > other > > record. You might call it a record grammar tree: > > > > http://people.redhat.com/sgrubb/audit/record-fields.html > > > > I'd like to align as many events as possible to pid,uid,auid section of the > > graph. > > > > -Steve > > - RGB - RGB -- Richard Guy Briggs <[email protected]> Kernel Security Engineering, Base Operating Systems, Red Hat Remote, Ottawa, Canada Voice: +1.647.777.2635, Internal: (81) 32635 -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
