From mboxrd@z Thu Jan  1 00:00:00 1970
From: Steve Grubb <sgrubb@redhat.com>
Subject: Re: Identifying writes to NFS
Date: Wed, 30 May 2007 14:06:04 -0400
Message-ID: <200705301406.04241.sgrubb@redhat.com>
References: <1180542928.5055.16.camel@localhost.localdomain>
	<20070530175634.GK27042@devserv.devel.redhat.com>
Mime-Version: 1.0
Content-Type: text/plain;
  charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
In-Reply-To: <20070530175634.GK27042@devserv.devel.redhat.com>
Content-Disposition: inline
List-Unsubscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

On Wednesday 30 May 2007 13:56, Alexander Viro wrote:
> > I'd like to be able to reliably recognise a PATH record which refers to
> > an NFS mount. 
> >
> > Any ideas? Thanks,
>
> man statfs, look at f_type field there.

While that does tell you the file system type, the audit rule comparitor does 
not use that field to trigger an event. Maybe that would be something useful 
to add to the comparitor?

Matthew, what kernel are you using?

-Steve