On Sunday 30 November 2008 10:11:10 Alexander Viro wrote: > > > Unfortunately, auto-mounts are, well, automatic, so there's no one to > > > issue that command. > > You do realize that they are, in the end, done from userland? Which is > the natural place to do that...
The problem is that's a little racy. But more importantly, it would be nice to load rules once since there is a chance that high security installations will have the audit system in immutable mode. For rules that do not resolve all the way to an inode, they could be put on a wait list that gets checked for resolution anytime mount is called. -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
