[RFC][PATCH] (#2) Prelim in-kernel file system auditing support

Chris Wright chrisw at osdl.org
Tue Jan 25 19:42:03 UTC 2005


* Serge Hallyn (serue at us.ibm.com) wrote:
> Right, so I guess the correct check will involve perhaps checking
> nd.last!=NULL before d_lookup, or dentry != nd.dentry after the
> d_lookup?
> 
> (I don't know offhand what nd.last looks like if you looked up '/'.)

Should depend on how you got their I think.  "/" vs. "../../../../.."

thanks,
-chris
-- 
Linux Security Modules     http://lsm.immunix.org     http://lsm.bkbits.net




More information about the Linux-audit mailing list