[PATCH] audit: watching subtrees
authorAl Viro <viro@zeniv.linux.org.uk>
Sun, 22 Jul 2007 12:04:18 +0000 (08:04 -0400)
committerAl Viro <viro@zeniv.linux.org.uk>
Sun, 21 Oct 2007 06:37:45 +0000 (02:37 -0400)
commit74c3cbe33bc077ac1159cadfea608b501e100344
tree4c4023caa4e15d19780255fa5880df3d36eb292c
parent455434d450a358ac5bcf3fc58f8913d13c544622
[PATCH] audit: watching subtrees

New kind of audit rule predicates: "object is visible in given subtree".
The part that can be sanely implemented, that is.  Limitations:
* if you have hardlink from outside of tree, you'd better watch
it too (or just watch the object itself, obviously)
* if you mount something under a watched tree, tell audit
that new chunk should be added to watched subtrees
* if you umount something in a watched tree and it's still mounted
elsewhere, you will get matches on events happening there.  New command
tells audit to recalculate the trees, trimming such sources of false
positives.

Note that it's _not_ about path - if something mounted in several places
(multiple mount, bindings, different namespaces, etc.), the match does
_not_ depend on which one we are using for access.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
fs/dcache.c
include/linux/audit.h
include/linux/dcache.h
init/Kconfig
kernel/Makefile
kernel/audit.c
kernel/audit.h
kernel/audit_tree.c [new file with mode: 0644]
kernel/auditfilter.c
kernel/auditsc.c