On 1/30/2019 4:58 PM, Richard Guy Briggs wrote:

Hello users of *audit_rule_match(),

As far as I can tell, it appears that the audit_context *actx parameter
to *audit_rule_match() is not used by any consumers in-tree upstream.
This includes selinux, apparmour, integrity and smack.
Might there be others out of tree that do use it (or did request it)?

I'm a bit puzzled that it was ever offered since it should be relatively
opaque and accessed only by audit or its accessor functions.

It was part of the 2008 commit 03d37d25e0f9 ("LSM/Audit: Introduce
generic Audit LSM hooks").

Would anyone object if I ripped out actx?

I don't see any reason to keep it based on what I see.
I don't see what it was supposed to be for, either.

- RGB

--
Richard Guy Briggs [off-list ref]
Sr. S/W Engineer, Kernel Security, Base Operating Systems
Remote, Ottawa, Red Hat Canada
IRC: rgb, SunRaycer
Voice: +1.647.777.2635, Internal: (81) 32635