On 7/28/20 8:49 AM, Thiébaud Weksteen wrote:
Thanks for the review! I'll send a new revision of the patch with the
%x formatter and using the TP_CONDITION macro.
On adding further information to the trace event, I would prefer
adding the strict minimum to be able to correlate the event with the
avc message. The reason is that tracevents have a fixed size (see
https://www.kernel.org/doc/Documentation/trace/events.txt). For
instance, we would need to decide on a maximum size for the string
representation of the list of permissions. This would also duplicate
the reporting done in the avc audit event. I'll simply add the pid as
part of the printk, which should be sufficient for the correlation.
Ok, also please use unsigned int for the fields and %u for the cls value.
(btw top-posting is discouraged for mailing list discussions, see
http://vger.kernel.org/lkml/#s3-9)
