[osiris] udev

[Gregor Mosheh]

Hey, guys. One thing we Linux 2.6 users may have noticed is /dev/.udev My
gosh, that filesystem is a pain in the neck, eh?

Have any of you come up with a ruleset that you've found minimizes the
false alarms coming from /dev/.udev ? I do not want to ExcludeAll the
entire /dev/.udev tree, because in the past I've seen a hackbot do its
dirty work under here --  the choice was probably intentional, to evade
detection by humans using HIDS like Orisis.

-- 
HostGIS
Cartographic development and hosting services
707-822-9355
http://www.HostGIS.com/