Re: [PATCH] audit: file system auditing based on location and name
On Wed, Jul 06, 2005 at 09:33:05PM -0400, Steve Grubb wrote:
On Wednesday 06 July 2005 19:50, Greg KH wrote:
> As inotify works off of open file descriptors, yes, this is true. ?But,
> again, if you think this is really important, then why not just work
> with inotify to provide that kind of support to it?
http://marc.theaimsgroup.com/?l=linux-kernel&m=110265021327578&w=2
I think Tim was told not to dig into inotify.
That was over 6 months ago. Things change :)
A lot of effort has been put into testing the code Tim has presented
with review from several kernel developers (listed in the cc). They
too should step up and give their opinion on this.
Sure, be glad to listen to them.
I want to believe questions were asked about this last December when
we were
starting into this effort. I think the conclusion from the inotify people was
for us to proceed and then when we know what we really want, we can refactor
should anything be in common.
I fail to see any refactoring here, why not make your patch rely on
theirs?
> I suggest you work together with the inotify developers to hash
out your
> differences, as it sounds like you are duplicating a lot of the same
> functionality.
Maybe yes and no. Now that the fs audit code is out, I think we can spot
commonality. The only common piece that I can think of is just the hook.
That's a good place to start.
The whole rest of it is different. I hope the inotify people comment
on this to see if there is indeed something that should be refactored.
I realize your userspace access is different, yet I do not believe yet
that it should be this way.
> Do you have any documetation or example userspace code that
shows how to
> use this auditfs interface you have created?
people.redhat.com/sgrubb/audit
No documentation on the auditfs interface :(
The audit package is currently distributed in Fedora Core 4. The code
to use
Tim's fs audit code is in the user space app, but is waiting for the kernel
pieces.
So the userspace package in FC4 will not use auditfs?
thanks,
greg k-h