Re: audit.49 kernel

On Wednesday 25 May 2005 12:29, Steve Grubb wrote: > On Wednesday 25 May 2005 12:34, Timothy R. Chavez wrote: > > Schnikies.  That's awfully suspicious.  I'll look into this after lunch > > Try this script with audit-0.9: > > #!/bin/bash > while [ 1 ] ; > do > echo "Inserting..." > auditctl -w /etc/passwd -k fk_passwd -p rwea > auditctl -w /var/run/dbus/system_bus_socket -k dbus-test -p rwea > echo "Deleting..." > auditctl -D > done Just a quick update. I've let this run for 5 minutes on x86_64 (UP) using audit-0.9