lkml.org 
[lkml]   [2004]   [Dec]   [10]   [last100]   RSS Feed
Views: [more markup]  [less markup]  [headers]  [forward] 
 
Messages in this thread
/
DateFri, 10 Dec 2004 08:36:23 +0100 (MET)
FromJan Engelhardt <>
SubjectRe: [audit] Upstream solution for auditing file system objects
>> Some notable design problems to introduce now are with the "identity"
>> of Y file/directory with respect to the kernel.  In fact, we only
>> really care about paths of which file/directory Y completes.  I.e: If
>> we want to audit /etc/shadow, we might not care if /etc/shadow is
>> moved to /tmp/shadow.  This means that any access/alteration of
>
>Of course you would.  A mv to /tmp/shadow includes an unlink, which
>should be an auditable event.

Does it really? If /etc and /tmp reside on the same filesystem, only a rename()
is done as to my knowledge (and possibly, an fs-specific rebalance). And if
they are on the same fs, they might even keep the inode number.

>> /tmp/shadow would go unnoticed (unless otherwise specified).  However,
>> if /tmp/shadow were a hardlink to /etc/shadow, we would then still
>> care, because we are still effectively /etc/shadow... if that makes
>> sense :-)

(Your mentioning of hardlinks proves my assumption of you having /etc and /tmp
on the same fs.)


Jan Engelhardt
-- 
ENOSPC
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 14:08    [from the cache]
©2003-2008