Hi Al,

On Thu, May 03, 2012 at 04:03:12AM +0100, Al Viro wrote:

How about splitting the damn thing into syscall_trace_enter() and
syscall_trace_exit(), losing the "why" argument along with all possible
confusion as to which audit hook to call?

That could certainly pan out to be slightly cleaner but I'd rather approach
it separately given that this stuff should go into the -stable trees and the
current fix is nicely self-contained.

I'll post some follow up patches.

Cheers,

Will