On Mon, Oct 16, 2017 at 7:04 PM, Richard Guy Briggs <[email protected]> wrote: > To use the AUDIT_TASK record idea, a local audit context would need to > be created and used for the AUDIT_CONFIG_CHANGE and AUDIT_TASK records > only.
For the record, the more I think about the AUDIT_TASK record idea, the more I'm souring on the idea. Someday when we get around to an attribute based format something like this will be handy (I'm thinking we will want higher granularity when it comes to records), but right now it doesn't seem very attractive to me. -- paul moore www.paul-moore.com -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
