Re: [RFC][PATCH] (#6) filesystem auditing
On Mon, 2005-03-14 at 17:14 -0600, Timothy R. Chavez wrote:
The hooks appear in:
fs/inode.c: destroy_inode(), alloc_inode()
fs/dcache.c: d_move(), d_delete(), __d_lookup()
fs/namei.c: permission(), exec_permission_lite(), may_delete()
I think I've corrected the d_move() leakage by placing two hooks to
audit_watch() in d_move() that works on the source dentry and the target
dentry.
What happened to your d_instantiate/d_splice_alias hooks?
--
Stephen Smalley <sds(a)tycho.nsa.gov>
National Security Agency