On Tue, 2006-08-08 at 09:19 -0400, Janak Desai wrote: > Klaus, would it be sufficient, for meeting LSPP requirement, to > audit write(2) of the fscreate file?
Doesn't audit write work via. inode numbers? If so I don't see how you could audit anything in /proc (try: ls -i /proc/self/.). Even if you can fix the inode stability problem, how can you specify to audit /proc/*/attr/fscreate? -- James Antill <[EMAIL PROTECTED]>
signature.asc
Description: This is a digitally signed message part
-- redhat-lspp mailing list [email protected] https://www.redhat.com/mailman/listinfo/redhat-lspp
