* Ondrej Zary ([EMAIL PROTECTED]) wrote: > This patch moves the "name=" field to the end of audit records. The > original placement is bad because it cannot be properly parsed. It is > impossible to tell if the name is "/bin/true" or "/bin/true inode=469634 > dev=00:00" because the "inode=" and "dev=" fields can be omitted. > > Before: > audit(1111008486.824:89346): item=0 name=/bin/true inode=469634 dev=00:00 > > After: > audit(1111008486.824:89346): item=0 inode=469634 dev=00:00 name=/bin/true > > Signed-off-by: Ondrej Zary <[EMAIL PROTECTED]>
Looks reasonable. Thanks, -chris -- Linux Security Modules http://lsm.immunix.org http://lsm.bkbits.net - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
