Re: [PATCH V9 2/3] audit: implement audit by executable

2015-08-07 Thread Paul Moore
On Friday, August 07, 2015 02:25:14 AM Richard Guy Briggs wrote: > On 15/08/06, Paul Moore wrote: > > > Merged, although some more minor whitespace tweaks were necessary for > > checkpatch. On a related note, if you're not running > > ./scripts/checlpatch.pl on your patches before sending them out

Re: [PATCH V9 2/3] audit: implement audit by executable

2015-08-06 Thread Richard Guy Briggs
On 15/08/06, Paul Moore wrote: > On Wednesday, August 05, 2015 04:29:37 PM Richard Guy Briggs wrote: > > This adds the ability audit the actions of a not-yet-running process. > > > > This patch implements the ability to filter on the executable path. Instead > > of just hard coding the ino and de

Re: [PATCH V9 2/3] audit: implement audit by executable

2015-08-06 Thread Paul Moore
On Wednesday, August 05, 2015 04:29:37 PM Richard Guy Briggs wrote: > This adds the ability audit the actions of a not-yet-running process. > > This patch implements the ability to filter on the executable path. Instead > of just hard coding the ino and dev of the executable we care about at the

[PATCH V9 2/3] audit: implement audit by executable

2015-08-05 Thread Richard Guy Briggs
This adds the ability audit the actions of a not-yet-running process. This patch implements the ability to filter on the executable path. Instead of just hard coding the ino and dev of the executable we care about at the moment the rule is inserted into the kernel, use the new audit_fsnotify infr