Re: CONFIG_AUDITFILESYSTEM RedHat only
On Tuesday 24 April 2007 17:58:10 Machin, Glenn D wrote:
Can anyone tell me if the RedHat Kernel configuration that allows one
to
watch filesystem objects made it back into the Linux Kernel Archives
(www.kernel.org)?
That config option is only valid in RHEL4U2 and higher kernels within the
RHEL4 series. That filesystem auditing attempt was rejected when it was
presented upstream on the basis of too much overlap with inotify. (6 months
prior we were told not to use inotify because we'd hurt its chances of
getting upstream.)
So, it was refactored and merged with the mainline kernel as of 2.6.19. (RHEL5
has all the right patches.) In the latest upstream kernels, you do not need
to use CONFIG_AUDITFILESYSTEM. It was decided that people might forget to
enable that option and only have half the functionality. So, if you specify
CONFIG_AUDITSYSCALL in current kernels, you get the whole thing.
Is this a RedHat only enhancement?
The one that's in RHEL4 is. Well, CentOS, too. But I've preserved the user
space commandline interface so that rules written for RHEL4 work just as well
with any 2.6.19 or later kernel.
-Steve