linux/init
Amy Griffis f368c07d72 [PATCH] audit: path-based rules
In this implementation, audit registers inotify watches on the parent
directories of paths specified in audit rules.  When audit's inotify
event handler is called, it updates any affected rules based on the
filesystem event.  If the parent directory is renamed, removed, or its
filesystem is unmounted, audit removes all rules referencing that
inotify watch.

To keep things simple, this implementation limits location-based
auditing to the directory entries in an existing directory.  Given
a path-based rule for /foo/bar/passwd, the following table applies:

    passwd modified -- audit event logged
    passwd replaced -- audit event logged, rules list updated
    bar renamed     -- rule removed
    foo renamed     -- untracked, meaning that the rule now applies to
		       the new location

Audit users typically want to have many rules referencing filesystem
objects, which can significantly impact filtering performance.  This
patch also adds an inode-number-based rule hash to mitigate this
situation.

The patch is relative to the audit git tree:
http://kernel.org/git/?p=linux/kernel/git/viro/audit-current.git;a=summary
and uses the inotify kernel API:
http://lkml.org/lkml/2006/6/1/145

Signed-off-by: Amy Griffis <amy.griffis@hp.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2006-06-20 05:25:27 -04:00
..
calibrate.c [PATCH] Platform SMIs and their interferance with tsc based delay calibration 2005-06-23 09:45:08 -07:00
do_mounts_devfs.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
do_mounts_initrd.c [PATCH] swsusp: userland interface 2006-03-23 07:38:07 -08:00
do_mounts_md.c [PATCH] md: remove personality numbering from md 2006-01-06 08:34:06 -08:00
do_mounts_rd.c [PATCH] s390: cleanup Kconfig 2006-01-06 08:33:53 -08:00
do_mounts.c [PATCH] root mount failure: emit filesystems attempted 2006-05-15 11:20:57 -07:00
do_mounts.h [PATCH] name_to_dev_t warning fix 2005-07-12 16:00:58 -07:00
initramfs.c [PATCH] initramfs: fix CPIO hardlink check 2006-05-15 11:20:55 -07:00
Kconfig [PATCH] audit: path-based rules 2006-06-20 05:25:27 -04:00
main.c [PATCH] silence initcall warnings 2006-05-01 18:17:43 -07:00
Makefile kbuild: "PREEMPT" in UTS_VERSION 2005-07-14 20:18:07 +00:00
version.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00