The kernel only uses struct audit_rule_data. We dropped support for struct audit_rule a long time ago. Drop the definition in the header file.
Showing the changes to include/uapi/linux (1 of 1 file). Show all
Unified · Split
| @@ -444,17 +444,4 @@ struct audit_rule_data { · 443 unmodified lines | |||
| 444 | char buf[0]; /* string fields buffer */ | 444 | char buf[0]; /* string fields buffer */ |
| 445 | }; | 445 | }; |
| 446 | 446 | ||
| 447 | /* audit_rule is supported to maintain backward compatibility with | ||
| 448 | * userspace. It supports integer fields only and corresponds to | ||
| 449 | * AUDIT_ADD, AUDIT_DEL and AUDIT_LIST requests. | ||
| 450 | */ | ||
| 451 | struct audit_rule { /* for AUDIT_LIST, AUDIT_ADD, and AUDIT_DEL */ | ||
| 452 | __u32 flags; /* AUDIT_PER_{TASK,CALL}, AUDIT_PREPEND */ | ||
| 453 | __u32 action; /* AUDIT_NEVER, AUDIT_POSSIBLE, AUDIT_ALWAYS */ | ||
| 454 | __u32 field_count; | ||
| 455 | __u32 mask[AUDIT_BITMASK_SIZE]; | ||
| 456 | __u32 fields[AUDIT_MAX_FIELDS]; | ||
| 457 | __u32 values[AUDIT_MAX_FIELDS]; | ||
| 458 | }; | ||
| 459 | |||
| 460 | #endif /* _UAPI_LINUX_AUDIT_H_ */ | 447 | #endif /* _UAPI_LINUX_AUDIT_H_ */ |