BSD process accounting has aq flag which notes whether a process has used
super user privs or not. Should it count if a process uses super user
privs to override file access permissions? Currently we don't take this
into account.
As long as everyone was careful to observe the convention that the
suser() test should be called at the *end* of logical OR or AND
statement, i.e.:
if ((current->euid != uid) && !suser())
return -EPERM;
.... then it would be a very simple matter of changing the suser()
command to set the "superuser privs used flag".
- Ted