Re: audit 0.7.4 released
On Mon, 09 May 2005 10:10:01 CDT, "Timothy R. Chavez" said:
I've removed the path_lookup from the audit_to_transport code
block.
Perhaps, we can attempt to find the path via user space once the watch
is returned (with path), rather then doing it in the kernel. Then user
space can set the w_valid field.
This sounds incredibly racy to me, especially in the cases we care about
(like the re-writing of /etc/passwd by creating a tempfile and renaming it).
Attachments:
- attachment.sig (application/pgp-signature — 226 bytes)