Audit with path exception rule

[Alexander Viro]

On Tue, Jul 24, 2007 at 03:47:59PM -0400, Steve Grubb wrote:
> On Monday 23 July 2007 11:25:22 am Ameel Kamboh wrote:
> > I would like to audit the file system for anyone creating new files
> > However I would like to exclude a directory from the watch list.
> >
> > Here is the sample I have:
> >
> > #3.     create/Remove any files
> > -a exit,always -S creat  -F path!=/var/myApp   <--- line 21
> > -a exit,always -S unlink -F path!=/var/myApp
> 
> I was hoping one of the kernel people was going to jump in with an answer 
> here. I have a feeling that the kernel doesn't allow it. I think it would be 
> trivial to patch the kernel to allow this and we should. The rule you are 
> trying to express seems reasonable to me.

The problem with that is simple - for that kind of rules we lose hash-based
overhead reduction we have for watches.

Basically, we distribute AUDIT_WATCH rules into a bunch of lists, by
hash(inumber(watched object)).  At match time we can skip most of them
immediately, by not walking every list.

Negative rules like that would have to go into "the rest" list and its
length is rather sensitive for overhead...