[PATCH] Exclude messages by message type
authorDustin Kirkland <dustin.kirkland@us.ibm.com>
Thu, 3 Nov 2005 16:12:36 +0000 (16:12 +0000)
committerAl Viro <viro@zeniv.linux.org.uk>
Mon, 20 Mar 2006 19:08:54 +0000 (14:08 -0500)
commitc8edc80c8b8c397c53f4f659a05b9ea6208029bf
tree0b09c0ff9ea28038b711d7368100302a1cc69b6d
parent73241ccca0f7786933f1d31b3d86f2456549953a
[PATCH] Exclude messages by message type

    - Add a new, 5th filter called "exclude".
    - And add a new field AUDIT_MSGTYPE.
    - Define a new function audit_filter_exclude() that takes a message type
      as input and examines all rules in the filter.  It returns '1' if the
      message is to be excluded, and '0' otherwise.
    - Call the audit_filter_exclude() function near the top of
      audit_log_start() just after asserting audit_initialized.  If the
      message type is not to be audited, return NULL very early, before
      doing a lot of work.
[combined with followup fix for bug in original patch, Nov 4, same author]
[combined with later renaming AUDIT_FILTER_EXCLUDE->AUDIT_FILTER_TYPE
and audit_filter_exclude() -> audit_filter_type()]

Signed-off-by: Dustin Kirkland <dustin.kirkland@us.ibm.com>
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
include/linux/audit.h
kernel/audit.c
kernel/auditsc.c