Re: peculiar disappearance of most audit rules
On Apr 21, 2014, at 11:28 AM, Steve Grubb <sgrubb(a)redhat.com> wrote:
What happens is that the text path that you put in a watch is a human
convenience. The kernel doesn't understand strings, it understands numbers. It
changes the path into device and inode information.
Cool. So I am guessing the rule works even if someone creates a hard link to the same
watched path and access files through that other path?
Todd
Attachments:
- attachment.html (text/html — 1.2 KB)