Hey Steve,

I was expecting it to not match the one with the spaces.

I can live with any answer; either disallowing spaces or allowing spaces and matching exactly, or (less desirable) even if it is desired to match the first occurrence of the string and it is noted as such in the man page.

The reason I tried the spaces was at direction from a security guy who was looking at a (now-mofied) RHEL 6 STIG beta release. I am not a fan of the spaces myself; was probably going to substitute underscores.

Thanks,

LCB

On Wed, Jun 19, 2013 at 5:34 AM, Steve Grubb <sgrubb@redhat.com> wrote:

On Tuesday, June 11, 2013 04:04:54 PM LC Bruzenak wrote:
> I was playing with audit rules using keys with spaces.
> Is the following expected (ignore the logic; was just testing the returns)?
>
> # auditctl -l -k lsmod
> LIST_RULES: exit,always watch=/sbin/lsmod perm=x key=lsmod kernel
> LIST_RULES: exit,always watch=/bin/ping perm=x key=lsmod ping

What are you expecting? I can make it not accept keys with spaces. I don't
think putting spaces in keys is a good idea.

-Steve

LC (Lenny) Bruzenak

lenny@magitekltd.com