audit.49 kernel

Timothy R. Chavez tinytim at us.ibm.com
Wed May 25 19:39:52 UTC 2005


On Wednesday 25 May 2005 14:33, Timothy R. Chavez wrote:
> On Wednesday 25 May 2005 12:29, Steve Grubb wrote:
> > On Wednesday 25 May 2005 12:34, Timothy R. Chavez wrote:
> > > Schnikies.  That's awfully suspicious.  I'll look into this after lunch
> > 
> > Try this script with audit-0.9:
> > 
> > #!/bin/bash
> > while [ 1 ] ;
> > do
> >         echo "Inserting..."
> >         auditctl -w /etc/passwd -k fk_passwd -p rwea
> >         auditctl -w /var/run/dbus/system_bus_socket -k dbus-test -p rwea
> >         echo "Deleting..."
> >         auditctl -D
> > done
> 
> Just a quick update.  I've let this run for 5 minutes on x86_64 (UP) using 
> audit-0.9 

Without problems, I should mention.

-tim




More information about the Linux-audit mailing list