Re: A question on monitoring time or time management changes in the kernel and the adjtimex system call
Steve Grubb <[email protected]>
| Newsgroups | com.redhat.linux-audit |
|---|---|
| Organization | Red Hat |
| Message-ID | <1921775.PYKUYFuaPT@x2> |
Hello, On Monday, January 9, 2023 2:33:39 AM EST Burn Alting wrote: > Would it be correct to say that when one sees an adjtimex system call audit > event, a change has occurred ONLY if either a AUDIT_TIME_ADJNTPVAL > (algorithm change) or AUDIT_TIME_INJOFFSET (time change) record is present > in the event? I think if you see either, time has been changed. I haven't studied the syscall to see if there isn't a sneak path, but I think they can be relied on. -Steve -- Linux-audit mailing list [email protected] https://listman.redhat.com/mailman/listinfo/linux-audit