Re: Unable to filter on negative values
k1rkland(a)us.ltcfwd.linux.ibm.com wrote on 02/14/2006 01:14:46 PM:
On Tue, 2006-02-14 at 13:17 -0500, Linda Knippers wrote:
> It seems to work with a rule like this:
> /sbin/auditctl -a exit,always -S pread64 -F success=no -F exit=9
Should we in userspace then translate something like
/sbin/auditctl -a exit,always -S pread64 -F exit=-9
to
/sbin/auditctl -a exit,always -S pread64 -F success=no -F exit=9
I would say yes, seeing as that is an audit-ism that people shouldn't be
forced to deal with. (And it should be a simple patch to get that to
work).
Mike
Attachments:
- attachment.html (text/html — 757 bytes)