)]}'
{
  "commit": "f368c07d7214a7c41dfceb76c8db473b850f0229",
  "tree": "e3f1e2d1a6ffbe61bf99ece51b906654728db4c9",
  "parents": [
    "20ca73bc792be9625af184cbec36e1372611d1c3"
  ],
  "author": {
    "name": "Amy Griffis",
    "email": "amy.griffis@hp.com",
    "time": "Fri Apr 07 16:55:56 2006 -0400"
  },
  "committer": {
    "name": "Al Viro",
    "email": "viro@zeniv.linux.org.uk",
    "time": "Tue Jun 20 05:25:27 2006 -0400"
  },
  "message": "[PATCH] audit: path-based rules\n\nIn this implementation, audit registers inotify watches on the parent\ndirectories of paths specified in audit rules.  When audit\u0027s inotify\nevent handler is called, it updates any affected rules based on the\nfilesystem event.  If the parent directory is renamed, removed, or its\nfilesystem is unmounted, audit removes all rules referencing that\ninotify watch.\n\nTo keep things simple, this implementation limits location-based\nauditing to the directory entries in an existing directory.  Given\na path-based rule for /foo/bar/passwd, the following table applies:\n\n    passwd modified -- audit event logged\n    passwd replaced -- audit event logged, rules list updated\n    bar renamed     -- rule removed\n    foo renamed     -- untracked, meaning that the rule now applies to\n\t\t       the new location\n\nAudit users typically want to have many rules referencing filesystem\nobjects, which can significantly impact filtering performance.  This\npatch also adds an inode-number-based rule hash to mitigate this\nsituation.\n\nThe patch is relative to the audit git tree:\nhttp://kernel.org/git/?p\u003dlinux/kernel/git/viro/audit-current.git;a\u003dsummary\nand uses the inotify kernel API:\nhttp://lkml.org/lkml/2006/6/1/145\n\nSigned-off-by: Amy Griffis \u003camy.griffis@hp.com\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "7c8780b150e6ac03489a93606e0e70cd29960096",
      "old_mode": 33188,
      "old_path": "include/linux/audit.h",
      "new_id": "c78327507f4ee9dc68e0d07292825476eef7d976",
      "new_mode": 33188,
      "new_path": "include/linux/audit.h"
    },
    {
      "type": "modify",
      "old_id": "3b36a1d536564e742d9d0b8d93f6db11d5a19c83",
      "old_mode": 33188,
      "old_path": "init/Kconfig",
      "new_id": "c4d0fa655d5dbefd9bc2bd792f902b142c9d8d5a",
      "new_mode": 33188,
      "new_path": "init/Kconfig"
    },
    {
      "type": "modify",
      "old_id": "0738a4b290e68b292d279cc124138a0fe1cb0354",
      "old_mode": 33188,
      "old_path": "kernel/audit.c",
      "new_id": "0fbf1c116363a8ae139bef90c36b2eca21a742c6",
      "new_mode": 33188,
      "new_path": "kernel/audit.c"
    },
    {
      "type": "modify",
      "old_id": "52cb1e31d522a4167c846d8cd52a8a88751e98e0",
      "old_mode": 33188,
      "old_path": "kernel/audit.h",
      "new_id": "58fa44cb8d01755079507eb018c37f4627071545",
      "new_mode": 33188,
      "new_path": "kernel/audit.h"
    },
    {
      "type": "modify",
      "old_id": "df9503da40fb19c30ddf6f5c8bba745df1f2590b",
      "old_mode": 33188,
      "old_path": "kernel/auditfilter.c",
      "new_id": "03a6919103d4df8368cda70a3a151b593f77548d",
      "new_mode": 33188,
      "new_path": "kernel/auditfilter.c"
    },
    {
      "type": "modify",
      "old_id": "14e295a4121b06d2d198d5052a900ea4fe9db046",
      "old_mode": 33188,
      "old_path": "kernel/auditsc.c",
      "new_id": "174a3f6248928e5dc14462b1d37b6aeaee252176",
      "new_mode": 33188,
      "new_path": "kernel/auditsc.c"
    }
  ]
}