Re: [PATCH v5 3/3] audit: Audit proc//cmdline aka proctitle

2014-02-11 Thread Richard Guy Briggs
On 14/02/11, William Roberts wrote: > On Tue, Feb 11, 2014 at 8:36 AM, Richard Guy Briggs wrote: > > On 14/02/06, William Roberts wrote: > >> During an audit event, cache and print the value of the process's > >> proctitle value (proc//cmdline). This is useful in situations > >> where processes ar

Re: [PATCH v5 3/3] audit: Audit proc//cmdline aka proctitle

2014-02-11 Thread William Roberts
I'm a liar v6 does not include rtrim and appears to be the same thing as v5. I'm posting v7 now, that has the acks I have received on the patches as well as rtrim on patch 3, the patch that adds the support to audit. Sorry for the confusion, ill buy the first 3 people who come to me that were inc

Re: [PATCH v5 3/3] audit: Audit proc//cmdline aka proctitle

2014-02-11 Thread William Roberts
The most up to date patches were v6. The difference between v5 and v6 is rtrim(). Did you not want the rtrim? Most things end with null bytes, this helps prevent hex-escaping when not needed. v6 - adds rtrim http://marc.info/?l=linux-kernel&m=139093195718315&w=2 http://marc.info/?l=linux-kernel&m=

Re: [PATCH v5 3/3] audit: Audit proc//cmdline aka proctitle

2014-02-11 Thread William Roberts
On Tue, Feb 11, 2014 at 8:36 AM, Richard Guy Briggs wrote: > On 14/02/06, William Roberts wrote: >> During an audit event, cache and print the value of the process's >> proctitle value (proc//cmdline). This is useful in situations >> where processes are started via fork'd virtual machines where th

Re: [PATCH v5 3/3] audit: Audit proc//cmdline aka proctitle

2014-02-11 Thread Richard Guy Briggs
On 14/02/06, William Roberts wrote: > During an audit event, cache and print the value of the process's > proctitle value (proc//cmdline). This is useful in situations > where processes are started via fork'd virtual machines where the > comm field is incorrect. Often times, setting the comm field

Re: [PATCH v5 3/3] audit: Audit proc//cmdline aka proctitle

2014-02-06 Thread Steve Grubb
On Thursday, February 06, 2014 10:15:28 AM William Roberts wrote: > During an audit event, cache and print the value of the process's > proctitle value (proc//cmdline). This is useful in situations > where processes are started via fork'd virtual machines where the > comm field is incorrect. Often

[PATCH v5 3/3] audit: Audit proc//cmdline aka proctitle

2014-02-06 Thread William Roberts
During an audit event, cache and print the value of the process's proctitle value (proc//cmdline). This is useful in situations where processes are started via fork'd virtual machines where the comm field is incorrect. Often times, setting the comm field still is insufficient as the comm width is n