Re: AUDIT_NETFILTER_CFG event format

On 2017-01-17 09:07, Steve Grubb wrote: > Hell Richard, > > While we're in the NETFILTER area, the CFG event is lacking some fields, too. > Its currently: > > table,family,entries > > its missing everything about *who* sent it: > pid,uid,auid,ses,subj,exe,res > > I'd suggest: > > pid,uid,auid,ses,subj,table,family,entries,exe,res > > to make it compatible with the majority of records. Ok, I've created an issue to track this: https://github.com/linux-audit/audit-kernel/issues/35

> Incidentally, I created a > chart that shows how each record type is alike and different from every other > record. You might call it a record grammar tree: > > http://people.redhat.com/sgrubb/audit/record-fields.html > > I'd like to align as many events as possible to pid,uid,auid section of the > graph. > > -Steve - RGB