Is unlink the audit equivalent of rmdir?

public inbox for linux-audit@redhat.com
 help / color / mirror / Atom feed

* Is unlink the audit equivalent of rmdir?
@ 2013-10-25 15:53 leam hall
  2013-10-25 16:19 ` Steve Grubb
  0 siblings, 1 reply; 2+ messages in thread
From: leam hall @ 2013-10-25 15:53 UTC (permalink / raw)
  To: linux-audit


[-- Attachment #1.1: Type: text/plain, Size: 168 bytes --]

For audit.rules purposes, if the stig.rules from the repo audits on unlink,
does that cover rmdir?

Thanks!

Leam
-- 
Mind on a Mission <http://leamhall.blogspot.com/>

[-- Attachment #1.2: Type: text/html, Size: 295 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]



^ permalink raw reply	[flat|nested] 2+ messages in thread

* Re: Is unlink the audit equivalent of rmdir?
  2013-10-25 15:53 Is unlink the audit equivalent of rmdir? leam hall
@ 2013-10-25 16:19 ` Steve Grubb
  0 siblings, 0 replies; 2+ messages in thread
From: Steve Grubb @ 2013-10-25 16:19 UTC (permalink / raw)
  To: linux-audit

On Friday, October 25, 2013 11:53:47 AM leam hall wrote:
> For audit.rules purposes, if the stig.rules from the repo audits on unlink,
> does that cover rmdir?

No. If you strace the rmdir command you will see what syscalls are involved. 
The rmdir syscall is involved.

-Steev

^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2013-10-25 16:19 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-10-25 15:53 Is unlink the audit equivalent of rmdir? leam hall
2013-10-25 16:19 ` Steve Grubb

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox