patch update to ~51

Steve Grubb sgrubb at redhat.com
Thu Jun 2 12:18:12 UTC 2005


On Wednesday 01 June 2005 17:30, Timothy R. Chavez wrote:
>   -> there's only two ways we can remove from a watchlist and neither will
>   contend with the other.
>
>      (2) audit_inode_data is being freed, inode is no longer reachable for
>           administrative action

So does this mean that when you have a watch on a file and the inode changes 
or is unreachable, the watch disappears? Shouldn't watches exist until 
deleted by the admin?

-Steve




More information about the Linux-audit mailing list