type for 3rd party events

Hi,

There is a request for a message type to be allocated allowing 3rd party kernel modules the ability to send audit events. This would be similar to the AUDIT_TRUSTED_APP type allocated for user space apps. I'm undecided about a name and could use some suggestions. My only thoughts right now are AUDIT_KERNEL_MODULE. Anyone have a better type name for 3rd party use?

Thanks,
-Steve

I'll throw some out...wouldn't necessarily call them better.

AUDIT_GENERIC_MODULE
AUDIT_MISC_KERN_MODULE
AUDIT_3RD_PARTY_MODULE

-- ljk

Maybe something like AUDIT_KERNEL_MISC ?

-Steve

That sounds like to can come from anywhere in the kernel vs just 3rd party modules. Maybe AUDIT_KERNEL_MISC_MOD?

I don't have much of an opinion here. Just trying to be helpful. :-)

-- ljk

For messages like that, is the fact it's a module at all relevant? (Consider the case of 3rd party code that's not a module, but builtin, either via patching or via 'CONFIG_3RDPARTY_FOO=y' rather than =m?)

Separating primary kernel vendor from self-inflicted 3rd party software would seem to be a more productive division.