[Bug 1196048] audit file watches do not really work?

https://bugzilla.suse.com/show_bug.cgi?id=1196048 https://bugzilla.suse.com/show_bug.cgi?id=1196048#c7 --- Comment #7 from Marcus Meissner <meissner@suse.com> --- Nice spotted with the symlink! The shell builtin ... i still fail to understand why it is not audited. the audit is for filewatch and this basically looks for file access system calls Bash supposedly uses system calls to open the file, write to it and close it. So bash builtin operations should be logged by the filewatch systemcall auditing the same way? -- You are receiving this mail because: You are on the CC list for the bug.