On Tuesday 20 May 2008 21:47:59 zhangxiliang wrote: > Sorry, I think my idea may be not express correctly. A example as follows: > 1, mkdir test > 2, touch test.c > 3, auditctl -w /home/test -k 11 > 4, auditctl -w /home/test.c -k 11
And then what did you do to create these records? > My question is why no information will be output by kernel hook funtion? What is missing? I can't tell what commands you run and what you expected to be output by the kernel. > Correct me if I am wrong, I think when watch a directory, kernel-audit can > also supply more information by kernel hook funtion What other information do you need? Also, note that -w rules are legacy for compatibility with RHEL4 kernel. They are used to express simple ideas like watch this file or directory subtree. If you want tight control over what you are auditing, you should use the syscall audit format where you can express more details about what you wanted to trigger on. IOW, you can express that you want changes to a directory itself rather than the files in the directory. -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
