From: Steve Grubb <sgrubb@redhat.com>
To: linux-audit@redhat.com
Subject: Re: File watching
Date: Tue, 20 Jun 2006 16:41:10 -0400 [thread overview]
Message-ID: <200606201641.10978.sgrubb@redhat.com> (raw)
In-Reply-To: <20060620203005.GB29481@zk3.dec.com>
On Tuesday 20 June 2006 16:30, Amy Griffis wrote:
> It would be nice if it were possible to further filter the open calls,
> by allowing the rule to specify certain flags like O_CREAT, O_RDONLY,
> O_WRONLY or O_RDWR. That could do quite a bit to eliminate
> unwanted log data.
>
> What do others think, should we consider adding somthing like this?
Yes, this is what the "rwex" flags to -p of auditctl allowed us to do. But we
also need to have a perm field that makes it easy to see what the requested
perm was.
-Steve
next prev parent reply other threads:[~2006-06-20 20:41 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2006-06-20 17:53 File watching Steve
2006-06-20 18:10 ` Jonathan Abbey
2006-06-20 18:22 ` Timothy R. Chavez
2006-06-20 18:32 ` Steve
2006-06-20 18:40 ` Timothy R. Chavez
2006-06-20 18:52 ` Steve
2006-06-20 18:55 ` Michael C Thompson
2006-06-20 19:08 ` Steve
2006-06-20 19:56 ` Valdis.Kletnieks
2006-06-20 18:52 ` Michael C Thompson
2006-06-20 20:30 ` Amy Griffis
2006-06-20 20:41 ` Steve Grubb [this message]
2006-06-20 21:06 ` Casey Schaufler
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=200606201641.10978.sgrubb@redhat.com \
--to=sgrubb@redhat.com \
--cc=linux-audit@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.