patch update to ~51

Timothy R. Chavez tinytim at us.ibm.com
Thu Jun 2 15:13:02 UTC 2005


On Thursday 02 June 2005 08:55, Steve Grubb wrote:
> On Thursday 02 June 2005 09:39, David Woodhouse wrote:
> > What you suggest would require a complete redesign, and I don't see a
> > way of doing it that would have any chance of being acceptable
> > upstream.
> 
> I checked. It seems like you cannot set watches on an umounted drive and then 
> mount it. So, there's no race-free way of setting watches before mounting. 
> Watches that are set and then the partition is unmounted & mounted survive.

This type of thing is beyond the scope of what we're doing.

> 
> Watches set on a file within a directory that gets renamed are deleted even 
> though the inode is the same:

Yes, that problem has been addressed and should no longer be the behavior
in audit.52.  Rename()'ing a directory does not destroy its watchlist.

Have you tried toe latest update?  If we still are draining the watchlist on a r
rename() that definitely needs to go away.

<snip>

-tim




More information about the Linux-audit mailing list