Re: A question about the directory watch in audit_tree.c in kernel
On Tuesday 20 May 2008 08:06:12 am Kevin Boyce wrote:
Correct me if I am wrong, but in doing the auditctl -w /home, the
only
thing that is being audited is the inode entry for the directory itself.
Not in new kernels. I think starting in 2.6.24 we have the ability to
recursively audit to the bottom of a given directory tree.
-Steve