[PATCH] audit: file system auditing based on location and name

David Woodhouse dwmw2 at infradead.org
Thu Jul 7 06:50:01 UTC 2005


On Thu, 2005-07-07 at 08:40 +0200, Arjan van de Ven wrote:
> why is this? It would be a very logical thing to store this stuff inside
> the inode. It sounds like a bad design to keep per inode data out of the
> inode. (if you're concerned about taking a lot of space, put a pointer
> to a kmalloc()'d piece of memory into the inode instead). A hash is
> just, well, odd for this.

There are _very_ few of these; it's very dubious whether it'd be worth
bloating the inode for them. The use of I_AUDIT also serves to pin the
inode in icache, and we'd need something like that even if we _weren't_
using it as a marker for the hash table.

-- 
dwmw2





More information about the Linux-audit mailing list