[RFC][PATCH] (#7U4) file system auditing by location and name

Steve Grubb sgrubb at redhat.com
Sat May 7 18:08:44 UTC 2005


On Saturday 07 May 2005 13:22, Steve Grubb wrote:
> My current theory is that audit_watch_cache is NULL.

I've confirmed this is the problem. The patch I sent earlier will output a 
message if watch_alloc is called and the cache pointer is NULL. I just 
checked my logs and the message is there.

The audit system get started very early in the boot sequence. I think its the 
first subsystem to get initted.  So the question is when should this get 
allocated? Should we do a lazy allocation? If so do we have any races to 
worry about?

-Steve




More information about the Linux-audit mailing list