[lkml]   [2005]   [Jul]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [PATCH] audit: file system auditing based on location and name
On Wed, Jul 06, 2005 at 11:54:41AM -0500, Timothy R. Chavez wrote:
> To implement this feature we rely on the concepts of a "watch" and
> "watch list". Directories hold lists of "watches" (ie: "watch lists")
> that describe auditable file names one level beneath them. If a file
> holds a pointer into a "watch list" it is auditable. When accessed by
> a system call, information about the inode and its "watches" is added
> to the audit context of the current task (an inode may have multiple
> "watches" if a hard link to a "watched" file is itself being "watched")
> which is sent to user space upon system call exit.

This sounds almost identical to inotify. Is there some way you could
use that instead? If not, you should explain why in your patch


greg k-h
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

 \ /
  Last update: 2005-07-06 22:09    [W:0.109 / U:0.288 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site