Re: [RFC][PATCH] (#6 U1) the latest incarnation

On Thu, 2005-03-24 at 14:48 -0600, Timothy R. Chavez wrote: This brings up another issue I wanted to discuss - whether the watch mask should be more general than rwea, e.g. should it be possible to specify that I want to see "rename", "link", "unlink", etc. with specific mask values for each of these operations. At that point, you would be passing your own set of mask values to audit_notify_watch (with a translation table for the normal permission mask). Alternatively, you could just view "rename", "link", and "unlink" as another form of write, so you could pass MAY_WRITE here. With regard to additional hook placement for audit_notify_watch, I think you likely do want to mirror the security*_post* hooks for file creation (create, mkdir, mknod, symlink), rename, and link with audit_notify_watch calls to perform notifications of such events. Then you keep audit_attach_watch calls in the dcache routines to manage the i_audit fields and avoid races. However, I think you need to check whether you truly need all of the current hook placements in the dcache routines or whether some of them are duplicative on the same code path, e.g. do you need both __d_lookup and d_instantiate/d_splice_alias hooked? -- Stephen Smalley <sds(a)tycho.nsa.gov&gt; National Security Agency