Adds new predicate ("event happened in subtree under <pathname>"). audit-subtree stuff; sat in -mm for several months. Please, pull from git://git.kernel.org/pub/scm/linux/kernel/git/viro/audit-current.git/ audit.b42
Al Viro <[EMAIL PROTECTED]> [PATCH] audit: watching subtrees [PATCH] new helper - inotify_evict_watch() [PATCH] new helper - inotify_clone_watch() [PATCH] new helpers - collect_mounts() and release_collected_mounts() [PATCH] pass dentry to audit_inode()/audit_inode_child() fs/dcache.c | 2 +- fs/debugfs/inode.c | 2 +- fs/inotify.c | 43 +++ fs/namei.c | 10 +- fs/namespace.c | 22 +- fs/open.c | 4 +- fs/pnode.h | 1 + fs/xattr.c | 8 +- include/linux/audit.h | 19 +- include/linux/dcache.h | 1 + include/linux/fs.h | 2 + include/linux/fsnotify.h | 9 +- include/linux/inotify.h | 2 + init/Kconfig | 4 + ipc/mqueue.c | 8 +- kernel/Makefile | 1 + kernel/audit.c | 87 +++++ kernel/audit.h | 34 ++- kernel/audit_tree.c | 903 ++++++++++++++++++++++++++++++++++++++++++++++ kernel/auditfilter.c | 64 +++- kernel/auditsc.c | 225 ++++++++++++- 21 files changed, 1411 insertions(+), 40 deletions(-) create mode 100644 kernel/audit_tree.c - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/