audit.49 kernel
Timothy R. Chavez
tinytim at us.ibm.com
Wed May 25 19:39:52 UTC 2005
On Wednesday 25 May 2005 14:33, Timothy R. Chavez wrote:
> On Wednesday 25 May 2005 12:29, Steve Grubb wrote:
> > On Wednesday 25 May 2005 12:34, Timothy R. Chavez wrote:
> > > Schnikies. That's awfully suspicious. I'll look into this after lunch
> >
> > Try this script with audit-0.9:
> >
> > #!/bin/bash
> > while [ 1 ] ;
> > do
> > echo "Inserting..."
> > auditctl -w /etc/passwd -k fk_passwd -p rwea
> > auditctl -w /var/run/dbus/system_bus_socket -k dbus-test -p rwea
> > echo "Deleting..."
> > auditctl -D
> > done
>
> Just a quick update. I've let this run for 5 minutes on x86_64 (UP) using
> audit-0.9
Without problems, I should mention.
-tim
More information about the Linux-audit
mailing list