On Mon, Dec 19, 2022 at 1:47 PM Casey Schaufler <casey@xxxxxxxxxxxxxxxx> wrote: > On 12/19/2022 9:54 AM, Ondrej Mosnacek wrote: > > Join the two fields that comprise an audit timestamp into a common > > structure. This will be used further in later commits. > > Patch 30/39 of my LSM stacking patchset[1] is almost identical to this. > The only significant difference is the structure name. You use audit_timestamp > whereas I use audit_stamp. I believe that audit_stamp is more correct and > more consistent with the code that uses it. > > [1] https://lore.kernel.org/lkml/f6b8ac05-6900-f57d-0daf-02d5ae53bc47@xxxxxxxxxxxxxxxx/T/#m3205b98b2a6b21a296fb831ed35892f01ead191f For the record, if "audit_stamp" and "audit_timestamp" are my only two options I prefer "audit_stamp" simply because it is shorter :) That said, see my comments on patch 2/2. While an audit timestamp struct improvement such as is proposed here and in the LSM stacking patchset is fine, I'm not in favor of exposing the audit timestamp outside the audit subsystem. -- paul-moore.com
