[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: [RFC][PATCH] (#2) Prelim in-kernel file system auditing support



On Thu, 2005-01-27 at 09:09, Stephen Smalley wrote:
> Possibly I missed earlier discussion of this issue, but I would have
> expected an audit watch to have an associated permission mask (i.e. I
> only want to watch for writes to /etc/passwd, not reads), and have
> audit_notify_watch() only add a entry to the audit context if the audit
> watch mask has a non-zero intersection with the requested permission
> mask.  Otherwise, you will be generating a ton of useless entries.

I suppose one exception to the above logic is if the mask specified for
the audit watch itself is 0, then you should always add the entry
regardless of the requested permission mask, so that you can audit even
existence tests (i.e. access(path, F_OK)) of the file if desired.  So
legitimate masks might be 0 (audit all accesses, even existence tests)
or any combination of MAY_READ, MAY_WRITE, MAY_EXEC, and MAY_APPEND
(audit only the specified kind of accesses).

-- 
Stephen Smalley <sds epoch ncsc mil>
National Security Agency


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]