Re: EXT :Re: CD Burner Auditing
On Tuesday, April 22, 2014 04:02:47 PM Steve Grubb wrote:
> You can use audit dispatcher to react to audit events.... When u
get a
> MOUNT event you can see where sr0 is mounted and start a new watch for
> that
> path. If you are not writing an ISO I think it has to be mounted.
I think hooking the udev rules might be better. This would let you check
for hot plug events where something is not yet mounted.
A long time ago during the RHEL5 LSPP certification, there was a project
created to help audit device allocation:
http://sourceforge.net/projects/devallocator/
There were 2 audit events created to assist in this. But if I recall, there
was a decision made to not support hot plug events. I forget why. The main
thing is that the code has the event in it formatted correctly. udev could be
patched to provide this event.
-Steve