patch update to ~51

Timothy R. Chavez tinytim at us.ibm.com
Sat Jun 4 20:43:27 UTC 2005


On Thursday 02 June 2005 06:03, David Woodhouse wrote:
> > * Allowing a _list_ of watches on a watched inode
> >   -> If the same inode is watched from multiple locations (or name spaces)
> 
> I think we definitely need this. Test case:
> 
>         touch /tmp/fish1
>         ln /tmp/fish1 /tmp/fish2
>         auditctl -w /tmp/fish1
>         auditctl -w /tmp/fish2
>         cat /tmp/fish1          # (see watch trigger)
>         cat /tmp/fish2          # (see watch trigger)
>         mv /tmp/fish2 /tmp/fish3  # (see watch trigger)
>         cat /tmp/fish3          # (see watch _NOT_ trigger)
>         cat /tmp/fish1          # (see watch trigger)
>         cat /tmp/fish3          # (see watch trigger again)

Ok, this appears to be working now with my changes.

I'm going to leave tests going all night and come back tommorrow and if all goes well, post a patch.

-tim




More information about the Linux-audit mailing list