Re: [PATCH] audit: file system auditing based on location and name

[Greg KH <greg@kroah.com>]

On Thu, Jul 07, 2005 at 02:49:09PM -0400, Steve Grubb wrote:
> On Thursday 07 July 2005 14:15, Greg KH wrote:
> > I fail to see any refactoring here, why not make your patch rely on
> > theirs?
> 
> At the time this code was developed, inotify was not in the kernel. We would 
> be patching against another patch that's not in the kernel.

You all are asking for this patch to be added to -mm, which contains
inotify.

> > > The whole rest of it is different. I hope the inotify people comment
> > > on this to see if there is indeed something that should be refactored.
> >
> > I realize your userspace access is different, yet I do not believe yet
> > that it should be this way.
> 
> The problems that we are faced with are dictated by CAPP and other security 
> profiles. The audit user space access has been in the kernel for over a year, 
> so that's not really a good thing to go changing.

You are adding auditfs, a new userspace access, right?  That's what I am
referring to.

> > No documentation on the auditfs interface :(
> 
> That's what Tim's email was providing. Its a new component.

His email provided no documentation that I could see.  Am I just missing
something?

> > > The audit package is currently distributed in Fedora Core 4. The code to
> > > use Tim's fs audit code is in the user space app, but is waiting for the
> > > kernel pieces.
> >
> > So the userspace package in FC4 will not use auditfs?
> 
> Right. You get a few warnings due to missing functionality. If the kernel were 
> patched with Tim's code, it all works as expected. We have worked out the 
> user space access and that shouldn't be changing.

Then what use is auditfs for if you don't need it?

Am I correct in thinking that you all need to split this patch into two
pieces, the new inode stuff, and auditfs, as neither one has anything to
do with the other?

Confused,

greg k-h