Re: need rules help - solved
On Wed, 2009-08-05 at 21:45 -0500, LC Bruzenak wrote:
I thought that the following would work:
-a never,exit -F subj_type=jcdx_mtdb_t -F obj_type=jcdx_stdb_var_t
Sorry for the false alarm. This one is operator error (at least I think
it is; will retest better, so far it appears to work as advertised).
I realized I had a rule to audit that event in the list.
This one needs the "-A' vice "-a" to ensure it goes to the head of the
rule line.
LCB.
--
LC (Lenny) Bruzenak
lenny(a)magitekltd.com