-w deprecation and -F dir= equivalence
by seth＠soulintheshell.com
Hello,
I read in the auditctl manual that -w $path is deprecated and should be
replaced by -F path=$path or -F dir=$path.
However it seems to me that their behavior is not the same, notably I
see auditd (4.0.2) fails to load its rules it $path does not
exists. $path may be created later in the system initialization or only
after a precise event (eg: /var/run/faillock in a tmpfs and only
created at first login).
So should I conclude that -w should still be used for paths that may not
exists at initialization ? Am I missing something ?
Is there a timeline for -w deprecation ?
Thanks,
-Seth
2 days, 6 hours
- 2
- 3
- ← Newer
- 1
- Older →