[prev in list] [next in list] [prev in thread] [next in thread] 

List:       linux-audit
Subject:    Re: [RFC] upstreaming audit filesystem pieces
From:       Amy Griffis <amy.griffis () hp ! com>
Date:       2005-08-26 22:36:32
Message-ID: 20050826223632.GA17099 () zk3 ! dec ! com
[Download RAW message or body]

Chris Wright wrote:     [Tue Aug 23 2005, 04:49:14PM EDT]
> > - The ability to begin watching a file at the moment of creation.
> >   Currently audit is pre-notified, via dcache hooks, when a file is
> >   created, moved, or deleted.  This allows audit to enable or disable
> >   a watch on the appropriate inode.  Audit would need a similar
> >   pre-notification, or preferably the ability to add (and possibly
> >   remove) watches from an Inotify event callback.
> 
> Inotify has a couple new dcache hooks, (iirc it's for delete), did you
> look at those yet?

I'm sorry about the delayed response, but yes, I've seen them.

[prev in list] [next in list] [prev in thread] [next in thread]