patch update to ~51

Steve Grubb sgrubb at redhat.com
Thu Jun 2 13:47:45 UTC 2005


On Thursday 02 June 2005 07:03, David Woodhouse wrote:
> I think we definitely need this. Test case:

This is good. I'd also suggest:

mv /tmp /old-tmp
cat /tmp/fish1
cat /old-tmp/fish1
mv /old-tmp /tmp
cat /tmp/fish1 <- should trigger here

umount /tmp
cat /tmp/fish1
mount /tmp
cat /tmp/fish1 <- should trigger here

auditctl -D
umount /tmp
auditctl -w /tmp/fish1
mount /tmp
cat /tmp/fish1 <- should trigger here

-Steve




More information about the Linux-audit mailing list