Re: Detecting execution of files in rwtab

2017-10-16 Thread Steve Grubb
On Monday, October 16, 2017 1:21:50 PM EDT Kevin Sullivan wrote: > Sorry if this topic has already been discussed, but I was unable to find > information about it in the mailing list. > > I am running auditd on a machine that is configured with readonly-root > support. For this configuration to wo

Detecting execution of files in rwtab

2017-10-16 Thread Kevin Sullivan
Sorry if this topic has already been discussed, but I was unable to find information about it in the mailing list. I am running auditd on a machine that is configured with readonly-root support. For this configuration to work, I have files listed in /etc/rwtab.d/ that need to be read-write, but ar