[RFC][PATCH] (#7U4) file system auditing by location and name

[Steve Grubb]

On Saturday 07 May 2005 14:08, Steve Grubb wrote:
> Should we do a lazy allocation? If so do we have any races to
> worry about?

OK, I decided to defer allocating the cache until its needed. (I make no 
warranties about races allocating the cache.) The attached patch is what I'm 
testing. Here's how it looks:

[root at endeavor ~]# auditctl -w /etc/passwd -k fk_passwd -p rwea
No rules
[root at endeavor ~]# auditctl -l
No rules
AUDIT_WATCH_LIST: dev=3:2, path=/etc/passwd, filterkey=fk_passwd, perms=15, 
valid=1
[root at endeavor ~]# auditctl -W /etc/passwd -k fk_passwd -p rwea
No rules
[root at endeavor ~]# auditctl -l
No rules
No watches

Everything looks fine so far. I need to fix auditctl so that it lists watches 
that get entered and then I can release the new audit package.

-Steve
-------------- next part --------------
A non-text attachment was scrubbed...
Name: linux-2.6.9-fs-trans.patch
Type: text/x-diff
Size: 6210 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20050507/7eff5ecd/attachment.bin>