Re: [RFC PATCH ghak21 0/4] audit: address ANOM_LINK excess records

2018-03-08 Thread Richard Guy Briggs
On 2018-02-14 22:46, Richard Guy Briggs wrote: > On 2018-02-14 11:49, Steve Grubb wrote: > > On Wednesday, February 14, 2018 11:18:20 AM EST Richard Guy Briggs wrote: > > > Audit link denied events were being unexpectedly produced in a disjoint > > > way when audit was disabled, and when they were

Re: [RFC PATCH ghak21 0/4] audit: address ANOM_LINK excess records

2018-02-14 Thread Richard Guy Briggs
On 2018-02-14 11:49, Steve Grubb wrote: > On Wednesday, February 14, 2018 11:18:20 AM EST Richard Guy Briggs wrote: > > Audit link denied events were being unexpectedly produced in a disjoint > > way when audit was disabled, and when they were expected, there were > > duplicate PATH records. This

Re: [RFC PATCH ghak21 0/4] audit: address ANOM_LINK excess records

2018-02-14 Thread Steve Grubb
On Wednesday, February 14, 2018 11:18:20 AM EST Richard Guy Briggs wrote: > Audit link denied events were being unexpectedly produced in a disjoint > way when audit was disabled, and when they were expected, there were > duplicate PATH records. This patchset addresses both issues for > symlinks an

[RFC PATCH ghak21 0/4] audit: address ANOM_LINK excess records

2018-02-14 Thread Richard Guy Briggs
Audit link denied events were being unexpectedly produced in a disjoint way when audit was disabled, and when they were expected, there were duplicate PATH records. This patchset addresses both issues for symlinks and hardlinks. This was introduced with commit b24a30a7305418ff138ff51776fc