patch update to ~51
Timothy R. Chavez
tinytim at us.ibm.com
Thu Jun 2 15:13:02 UTC 2005
On Thursday 02 June 2005 08:55, Steve Grubb wrote:
> On Thursday 02 June 2005 09:39, David Woodhouse wrote:
> > What you suggest would require a complete redesign, and I don't see a
> > way of doing it that would have any chance of being acceptable
> > upstream.
>
> I checked. It seems like you cannot set watches on an umounted drive and then
> mount it. So, there's no race-free way of setting watches before mounting.
> Watches that are set and then the partition is unmounted & mounted survive.
This type of thing is beyond the scope of what we're doing.
>
> Watches set on a file within a directory that gets renamed are deleted even
> though the inode is the same:
Yes, that problem has been addressed and should no longer be the behavior
in audit.52. Rename()'ing a directory does not destroy its watchlist.
Have you tried toe latest update? If we still are draining the watchlist on a r
rename() that definitely needs to go away.
<snip>
-tim
More information about the Linux-audit
mailing list