Messages in this thread | | | Date | Fri, 14 Aug 2020 14:30:50 -0400 | From | Steven Rostedt <> | Subject | Re: [PATCH v2 1/2] selinux: add tracepoint on denials |
| |
On Fri, 14 Aug 2020 20:06:34 +0200 peter enderborg <peter.enderborg@sony.com> wrote:
> Im find with that, but then you can not do filtering? I would be > pretty neat with a filter saying tclass=file permission=write. >
Well, if the mapping is stable, you could do:
(tclass == 6) && (audited & 0x4)
-- Steve
| |