[RFC][PATCH] (#4) auditfs

Timothy R. Chavez chavezt at gmail.com
Wed Feb 23 23:40:22 UTC 2005


On Wed, 23 Feb 2005 17:26:44 -0600, Timothy R. Chavez <chavezt at gmail.com> wrote:
<snip>
> Ok, great.  I've removed the hooks.  I can also get away with taking
> the hooks out of unlink right because I should be hitting permission()
> in access(), before I do the unlink()?
> --
> - Timothy R. Chavez
> 

Of course, to get information about unlink() via access, I have to be
auditing access().  But that's cake.

-- 
- Timothy R. Chavez




More information about the Linux-audit mailing list