On Apr 21, 2014, at 11:28 AM, Steve Grubb <[email protected]> wrote:
> What happens is that the text path that you put in a watch is a human > convenience. The kernel doesn't understand strings, it understands numbers. > It > changes the path into device and inode information. Cool. So I am guessing the rule works even if someone creates a hard link to the same watched path and access files through that other path? Todd
-- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
