converting audit subsystem to markers for systemtap access

[Frank Ch. Eigler]

Hi -

On Sun, Oct 21, 2007 at 04:32:08PM -0400, Steve Grubb wrote:
> On Sunday 21 October 2007 13:25:38 Frank Ch. Eigler wrote:
> [...]
> > David/Steve, does this sound interesting enough to explore in code?
> 
> Not sure - I've never used system tap, so I don't know exactly what it does.

(See http://sources.redhat.com/systemtap/documentation.htm.)

> I'd suggest discussing this on linux-audit mail list since this can impact 
> our next CC eval and I'm not the one it could impact the most. Please CC Al 
> Viro since he's doing the audit kernel work these days. 

OK.  I omitted linux-audit@ because linux/MAINTAINERS lists it as a
"subscriber-only" mailing list.

> In general, the audit system is not something I'd like to see messed
> with. [...]

Understood.  As far as the audit code were concerned, it would add one
layer of function-call indirection, with no behavioral changes at all.
Adopting markers would merely permit other applications to listen in
to the same events too, without having to add more and more hooks.

- FChE