peculiar disappearance of most audit rules

[lists_todd at mac.com]

On Apr 21, 2014, at 11:28 AM, Steve Grubb <sgrubb at redhat.com> wrote:

> What happens is that the text path that you put in a watch is a human 
> convenience. The kernel doesn't understand strings, it understands numbers. It 
> changes the path into device and inode information.

Cool. So I am guessing the rule works even if someone creates a hard link to the same watched path and access files through that other path?

Todd

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20140421/10ce7a3d/attachment.htm>