Re: minor rule questions
On Thursday 08 May 2008 13:14:12 LC Bruzenak wrote:
MINOR: It appears that there needs to be a space between the
"key=xxx"
and "list=N" results from "ausearch -i -ts today":
Thanks, added to the TODO file.
I'm sure this one is on startup when the audit.rules file is
parsed and
the auditctls all happen.
Looks like its from the interpret option of ausearch.
And what does the "list=N" part represent?
The kernel filter list that the rule was added to.
Would it be the following (i.e. exit):
#define AUDIT_FILTER_EXIT 0x04 /* Apply rule at syscall exit */
Yes.
-Steve