The AUDIT_FILTER_TYPE name is vague and misleading due to not describing where or when the filter is applied and obsolete due to its available filter fields having been expanded. Userspace has already renamed it from AUDIT_FILTER_TYPE to AUDIT_FILTER_EXCLUDE without checking if it already exists. The userspace maintainer assures that as long as it is set to the same value it will not be a problem since the userspace code does not treat compiler warnings as errors. If this policy changes then checks if it already exists can be added at the same time. See: https://github.com/linux-audit/audit-kernel/issues/89
Showing the changes to include/uapi/linux (1 of 3 files). Show all
Unified · Split
| @@ -157,7 +157,8 @@ · 156 unmodified lines | ||
| 157 | 157 | #define AUDIT_FILTER_ENTRY 0x02 /* Apply rule at syscall entry */ |
| 158 | 158 | #define AUDIT_FILTER_WATCH 0x03 /* Apply rule to file system watches */ |
| 159 | 159 | #define AUDIT_FILTER_EXIT 0x04 /* Apply rule at syscall exit */ |
| 160 | −#define AUDIT_FILTER_TYPE 0x05 /* Apply rule at audit_log_start */ | |
| 160 | +#define AUDIT_FILTER_EXCLUDE 0x05 /* Apply rule before record creation */ | |
| 161 | +#define AUDIT_FILTER_TYPE AUDIT_FILTER_EXCLUDE /* obsolete misleading naming */ | |
| 161 | 162 | #define AUDIT_FILTER_FS 0x06 /* Apply rule at __audit_inode_child */ |
| 162 | 163 | |
| 163 | 164 | #define AUDIT_NR_FILTERS 7 |