exclude's effect with multiple rules - Linux-audit - Linux-Audit List Archives

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

exclude's effect with multiple rules

audit 1.2.6 released

AUDIT_PERM support

Michael C Thompson

Friday, 25 August 2006 Fri, 25 Aug '06

5:04 p.m.

Hey all, So if I have the following two rules, what should be expected behaviour? auditctl -a entry,always -S chmod auditctl -a exclude,always -S all ... Assume we can change the ordering. Thanks, Mike

Reply

Show replies by date

Steve Grubb

Friday, 25 August Fri, 25 Aug

7:50 p.m.

On Friday 25 August 2006 18:04, Michael C Thompson wrote:

So if I have the following two rules, what should be expected behaviour? auditctl -a entry,always -S chmod auditctl -a exclude,always -S all

The expected behavior is that rule 1 is accepted and rule 2 produces an error and is rejected. -Steve

Reply

6692

days inactive

6693

days old

linux-audit@lists.linux-audit.osci.io

Manage subscription

1 comments

2 participants

tags (0)

participants (2)

Michael C Thompson
Steve Grubb