audit.19 kernel

David Woodhouse dwmw2 at infradead.org
Mon Apr 11 12:47:41 UTC 2005


On Fri, 2005-04-08 at 16:34 +0100, David Woodhouse wrote:
> On Fri, 2005-04-08 at 10:15 -0500, Timothy R. Chavez wrote:
> > > I am seeing an inconsistent behavior when testing the watches with this
> > > kernel. Is anybody else encountering something similar?
> > >
> > 
> > Just to be clearer, we tested on my working-version of the code, and I _do_ 
> > receive records.  I've not touched audit_attach/notify_watch() either.
> 
> I'll double-check my backport of your code.

What file system are you testing on? Does it have its own permission()
routine? I put the audit_notify_watch() in vfs_permission() instead of
permission() by mistake; I'm building an audit.20 with that fixed.

-- 
dwmw2




More information about the Linux-audit mailing list