Re: peculiar disappearance of most audit rules

lists_todd
2014-04-21T18:35:16Z

[-- Attachment #1.1: Type: text/plain, Size: 429 bytes --]

On Apr 21, 2014, at 11:28 AM, Steve Grubb <sgrubb@redhat.com> wrote:

> What happens is that the text path that you put in a watch is a human
> convenience. The kernel doesn't understand strings, it understands numbers. It
> changes the path into device and inode information.

Cool. So I am guessing the rule works even if someone creates a hard link to the same watched path and access files through that other path?

Todd

[-- Attachment #1.2: Type: text/html, Size: 1192 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]