Re: [PATCH ghak109 V1] audit: link integrity evm_write_xattrs record to syscall event
From: Matthew Garrett <hidden>
Date: 2019-03-26 17:56:11
Also in:
linux-integrity, lkml
On Tue, Mar 26, 2019 at 10:43 AM Richard Guy Briggs [off-list ref] wrote:
Ok, what I typed above wasn't quite what I intended... This is what I
meant:
audit_log_format(ab, "xattr=");
audit_log_untrustedstring(ab, ".");
But, I'll just move the normal case above the "." locking detection and
log all cases the same way.Sounds good to me.