patch update to ~51
Steve Grubb
sgrubb at redhat.com
Thu Jun 2 12:18:12 UTC 2005
On Wednesday 01 June 2005 17:30, Timothy R. Chavez wrote:
> -> there's only two ways we can remove from a watchlist and neither will
> contend with the other.
>
> (2) audit_inode_data is being freed, inode is no longer reachable for
> administrative action
So does this mean that when you have a watch on a file and the inode changes
or is unreachable, the watch disappears? Shouldn't watches exist until
deleted by the admin?
-Steve
More information about the Linux-audit
mailing list