[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: How to tell what process accessed a file

On Sat, Feb 14, 2004 at 01:50:06PM -0600, hanasaki wrote:
> what package and deamon does the audit of every file executed?

RSBAC has such a facility.

Executing is done by calling execve(2).  The section number `2' informs
us this is a system call.  Therefore, such an accounting must be
kernel-based to be reliable.  No daemon/package alone can do the job.


Jan Minar                   "Please don't CC me, I'm subscribed." x 9

Attachment: pgpBim90HJfDd.pgp
Description: PGP signature

Reply to: