Re: [PATCH v2 1/2] selinux: add tracepoint on denials

[Steven Rostedt]

On Fri, 14 Aug 2020 20:06:34 +0200
peter enderborg <peter.enderborg@xxxxxxxx> wrote:

> Im find with that, but then you  can not do filtering? I would be
> pretty neat with a filter saying tclass=file permission=write.
> 

Well, if the mapping is stable, you could do:

	(tclass == 6) && (audited & 0x4)

-- Steve