7:28 a.m.
In the audit.rules file, is there a difference between "-a exit,always"
and "-a always,exit"?
Thanks!
Leam
--
Mind on a Mission <http://leamhall.blogspot.com/>
7:36 a.m.
You and everyone I know. However, the SCC scan tool is hitting as it
expects "exit,always". Ugh...
Leam
On Thu, Apr 3, 2014 at 8:32 AM, Steve Grubb <sgrubb(a)redhat.com> wrote:
On Thursday, April 03, 2014 08:28:59 AM leam hall wrote:
> In the audit.rules file, is there a difference between "-a exit,always"
> and "-a always,exit"?
Nope. Both work fine. I think that for consistency, I have fixed all rules
files
to use "-a always,exit".
-Steve
--
Mind on a Mission <http://leamhall.blogspot.com/>
8:23 a.m.
On Thursday, April 03, 2014 08:36:21 AM leam hall wrote:
You and everyone I know. However, the SCC scan tool is hitting as it
expects "exit,always". Ugh...
This would be a SCAP content issue. In doing some research, I found that the
problem appears to have been solved in the audit-2.0.6 release. It also seems
that a couple rules got accidentally re-introduced in 2.2.3 but was fixed again
in 2.3.2.
But going back to the content, I just grep'ed through the SSG project and see
that they are testing for reversed fields. I'll tell them to fix that.
-Steve
On Thu, Apr 3, 2014 at 8:32 AM, Steve Grubb <sgrubb(a)redhat.com>
wrote:
> On Thursday, April 03, 2014 08:28:59 AM leam hall wrote:
> > In the audit.rules file, is there a difference between "-a
exit,always"
> > and "-a always,exit"?
>
> Nope. Both work fine. I think that for consistency, I have fixed all rules
> files
> to use "-a always,exit".
>
> -Steve
8:25 a.m.
Quick workaround is sed, if you don't have a lot of files to fix. :)
Leam
On Thu, Apr 3, 2014 at 9:23 AM, Steve Grubb <sgrubb(a)redhat.com> wrote:
On Thursday, April 03, 2014 08:36:21 AM leam hall wrote:
> You and everyone I know. However, the SCC scan tool is hitting as it
> expects "exit,always". Ugh...
This would be a SCAP content issue. In doing some research, I found that
the
problem appears to have been solved in the audit-2.0.6 release. It also
seems
that a couple rules got accidentally re-introduced in 2.2.3 but was fixed
again
in 2.3.2.
But going back to the content, I just grep'ed through the SSG project and
see
that they are testing for reversed fields. I'll tell them to fix that.
-Steve
> On Thu, Apr 3, 2014 at 8:32 AM, Steve Grubb <sgrubb(a)redhat.com> wrote:
> > On Thursday, April 03, 2014 08:28:59 AM leam hall wrote:
> > > In the audit.rules file, is there a difference between "-a
exit,always"
> > > and "-a always,exit"?
> >
> > Nope. Both work fine. I think that for consistency, I have fixed all
rules
> > files
> > to use "-a always,exit".
> >
> > -Steve
--
Mind on a Mission <http://leamhall.blogspot.com/>
3864
days inactive
3864
days old
linux-audit@lists.linux-audit.osci.io
4 comments
2 participants
participants (2)
-
leam hall -
Steve Grubb