Here's a patch for version 2.1.3 which solves bug 435682 ( https://bugzilla.redhat.com/show_bug.cgi?id=435682 ). Patched auditctl allows to specify files having spaces in ther names - just surround a filename with apostrophes.

> Here's a patch for version 2.1.3 which solves bug 435682 ( > https://bugzilla.redhat.com/show_bug.cgi?id=435682 ). > Patched auditctl allows to specify files having spaces in ther names > - just surround a filename with apostrophes. This patch also arbitrarily breaks handling of apostrophes and \xFF characters in filenames; it probably is a marginal improvement, but any change to the format should IMHO start with an explicit and consistent specification of how quoting is supposed to work in audit.rules, and then implementing exactly that. If we do have to change the file format to support spaces, let's do it, but let's also make sure that we don't need to change it again soon to fix different artifacts of the parser implementation. Mirek