Re: [PATCH][RFC] Light-weight Auditing Framework

[Chris Wright <chrisw@osdl.org>]

* Rik Faith (faith@redhat.com) wrote:
> > Doesn't seem like CONFIG_AUDIT=n disables all the code.
>
> The bit tests in entry.S are still there, but those are the same tests
> that are used for ptrace, and there is nothing that sets the bits.  So,
> aside from that test, all of the code should be disabled.

I think, e.g. the code that calls audit_get/putname is still there.

> Except where noted below, I have either incorporated all your
> suggestions or made notes in the code to do so later.  The new patch is
> at: http://people.redhat.com/faith/audit/audit-20040302.1632.patch

Oops, I wasn't clear re: the static initialized data...I just meant to
give a couple examples, there were more:

+static int         audit_default = 0;
+static int         audit_pid = 0;
+static int         audit_rate_limit    = 0;
+static int         audit_freelist_count = 0;
etc...

thanks,
-chris
-- 
Linux Security Modules     http://lsm.immunix.org     http://lsm.bkbits.net