Re: A question about the directory watch in audit_tree.c in kernel
On Tuesday 20 May 2008 21:47:59 zhangxiliang wrote:
Sorry, I think my idea may be not express correctly. A example as
follows:
1, mkdir test
2, touch test.c
3, auditctl -w /home/test -k 11
4, auditctl -w /home/test.c -k 11
And then what did you do to create these records?
My question is why no information will be output by kernel hook
funtion?
What is missing? I can't tell what commands you run and what you expected to
be output by the kernel.
Correct me if I am wrong, I think when watch a directory,
kernel-audit can
also supply more information by kernel hook funtion
What other information do you need?
Also, note that -w rules are legacy for compatibility with RHEL4 kernel. They
are used to express simple ideas like watch this file or directory subtree.
If you want tight control over what you are auditing, you should use the
syscall audit format where you can express more details about what you wanted
to trigger on. IOW, you can express that you want changes to a directory
itself rather than the files in the directory.
-Steve