Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
Amy Griffis f368c07d72 [PATCH] audit: path-based rules ... In this implementation, audit registers inotify watches on the parent directories of paths specified in audit rules. When audit's inotify event handler is called, it updates any affected rules based on the filesystem event. If the parent directory is renamed, removed, or its filesystem is unmounted, audit removes all rules referencing that inotify watch. To keep things simple, this implementation limits location-based auditing to the directory entries in an existing directory. Given a path-based rule for /foo/bar/passwd, the following table applies: passwd modified -- audit event logged passwd replaced -- audit event logged, rules list updated bar renamed -- rule removed foo renamed -- untracked, meaning that the rule now applies to the new location Audit users typically want to have many rules referencing filesystem objects, which can significantly impact filtering performance. This patch also adds an inode-number-based rule hash to mitigate this situation. The patch is relative to the audit git tree: http://kernel.org/git/?p=linux/kernel/git/viro/audit-current.git;a=summary and uses the inotify kernel API: http://lkml.org/lkml/2006/6/1/145 Signed-off-by: Amy Griffis <amy.griffis@hp.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>		2006-06-20 05:25:27 -04:00
..
irq
power
.gitignore
acct.c
audit.c	[PATCH] audit: path-based rules	2006-06-20 05:25:27 -04:00
audit.h	[PATCH] audit: path-based rules	2006-06-20 05:25:27 -04:00
auditfilter.c	[PATCH] audit: path-based rules	2006-06-20 05:25:27 -04:00
auditsc.c	[PATCH] audit: path-based rules	2006-06-20 05:25:27 -04:00
capability.c
compat.c
configs.c
cpu.c
cpuset.c	[PATCH] cpuset: might_sleep_if check in cpuset_zones_allowed	2006-05-21 12:59:18 -07:00
dma.c
exec_domain.c
exit.c	[PATCH] run_posix_cpu_timers: remove a bogus BUG_ON()	2006-06-17 10:52:13 -07:00
extable.c	[PATCH] symbol_put_addr() locks kernel	2006-05-15 11:20:55 -07:00
fork.c
futex.c
futex_compat.c
hrtimer.c	[PATCH] hrtimer: export symbols	2006-05-31 16:27:11 -07:00
intermodule.c
itimer.c
kallsyms.c
Kconfig.hz
Kconfig.preempt
kexec.c
kfifo.c
kmod.c
kprobes.c
ksysfs.c
kthread.c
Makefile
module.c	[PATCH] symbol_put_addr() locks kernel	2006-05-15 11:20:55 -07:00
mutex-debug.c
mutex-debug.h
mutex.c
mutex.h
panic.c
params.c
pid.c
posix-cpu-timers.c	[PATCH] arm_timer: remove a racy and obsolete PF_EXITING check	2006-06-17 10:52:13 -07:00
posix-timers.c
printk.c
profile.c
ptrace.c
rcupdate.c	[PATCH] RCU: introduce rcu_needs_cpu() interface	2006-05-15 11:20:55 -07:00
rcutorture.c
relay.c
resource.c
sched.c	Revert "[PATCH] sched: fix interactive task starvation"	2006-05-21 18:54:09 -07:00
seccomp.c
signal.c	[PATCH] collect sid of those who send signals to auditd	2006-06-20 05:25:21 -04:00
softirq.c
softlockup.c
spinlock.c
stop_machine.c
sys.c
sys_ni.c
sysctl.c	[PATCH] inotify (1/5): split kernel API from userspace support	2006-06-20 05:25:17 -04:00
time.c
timer.c	[PATCH] Fix a NO_IDLE_HZ timer bug	2006-05-21 12:59:21 -07:00
uid16.c
user.c	[PATCH] inotify (1/5): split kernel API from userspace support	2006-06-20 05:25:17 -04:00
wait.c
workqueue.c