Ondrej Mosnáček

I don't know, the libkcapi AIO encrypt/decrypt functions seem badly designed to me... The behavior is undefined for pretty much any skcipher but `ecb(...)` if you pass more han one...

At the moment we have a blanket rule in selinux-policy to allow all processes to use userfaultfd (and other anon_inodes), but we didn't account for the case where such file...

@zpytela Sorry, I forgot to reply here... Yes, that's pretty much what I had in mind.

Preliminary verbatim import of version 0.1 for review: https://github.com/WOnder93/audit-validation

I had a quick look at the code and I have the impression that this tool is still a bit crude and unfinished. Basically, it currently does two things: *...

I could take on this and #11, but I don't have permissions to create a repo in linux-audit. I think only @pcmoore can do that.

That's a good idea. I imported the two available versions (0.5 and 0.6) of `ausearch-test` here: https://github.com/WOnder93/ausearch-test What discussion and questions do you have in mind?

> * How does one install the test (e.g. what dependencies are there, if any)? > * It looks like the entire test (suite?) is a single C file, are...

Well, the idea is (I think): * You start with an initial collection of (real-world) records that you expect ausearch to handle correctly. You run the test - if it...

> I don't see any mention of dependencies in the README. A quick inspection of the header files and Makefile would seem to indicate that audit-libs-devel is required on Fedora/RHEL...