tree ace9af6bbc3cf711f43cfd88e834baeb6989ca3f
parent 9262e9149f346a5443300f8c451b8e7631e81a42
author Amy Griffis <amy.griffis@hp.com> 1150325121 -0400
committer Al Viro <viro@zeniv.linux.org.uk> 1151746986 -0400

[PATCH] add rule filterkey

Add support for a rule key, which can be used to tie audit records to audit
rules.  This is useful when a watched file is accessed through a link or
symlink, as well as for general audit log analysis.

Because this patch uses a string key instead of an integer key, there is a bit
of extra overhead to do the kstrdup() when a rule fires.  However, we're also
allocating memory for the audit record buffer, so it's probably not that
significant.  I went ahead with a string key because it seems more
user-friendly.

Note that the user must ensure that filterkeys are unique.  The kernel only
checks for duplicate rules.

Signed-off-by: Amy Griffis <amy.griffis@hpd.com>