[PATCH 1/2] audit: introduce a struct to represent an audit timestamp

[Paul Moore]

On Mon, Dec 19, 2022 at 1:47 PM Casey Schaufler <casey at schaufler-ca.com> wrote:
> On 12/19/2022 9:54 AM, Ondrej Mosnacek wrote:
> > Join the two fields that comprise an audit timestamp into a common
> > structure. This will be used further in later commits.
>
> Patch 30/39 of my LSM stacking patchset[1] is almost identical to this.
> The only significant difference is the structure name. You use audit_timestamp
> whereas I use audit_stamp. I believe that audit_stamp is more correct and
> more consistent with the code that uses it.
>
> [1] https://lore.kernel.org/lkml/f6b8ac05-6900-f57d-0daf-02d5ae53bc47@schaufler-ca.com/T/#m3205b98b2a6b21a296fb831ed35892f01ead191f

For the record, if "audit_stamp" and "audit_timestamp" are my only two
options I prefer "audit_stamp" simply because it is shorter :)

That said, see my comments on patch 2/2.  While an audit timestamp
struct improvement such as is proposed here and in the LSM stacking
patchset is fine, I'm not in favor of exposing the audit timestamp
outside the audit subsystem.

-- 
paul-moore.com