key options with spaces
- First Post
- Replies
- Stats
-
Go to
- ----- 2024 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2023 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2022 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2021 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2020 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2019 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2018 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2017 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2016 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2015 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2014 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2013 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2012 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2011 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2010 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2009 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2008 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2007 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2006 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2005 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2004 -----
- December
- November
- October
- September
- August
I was playing with audit rules using keys with spaces.
Is the following expected (ignore the logic; was just testing the returns)?
# auditctl -l -k lsmod
LIST_RULES: exit,always watch=/sbin/lsmod perm=x key=lsmod kernel
LIST_RULES: exit,always watch=/bin/ping perm=x key=lsmod ping
Thx,
LCB
--
LC (Lenny) Bruzenak
lenny(a)magitekltd.com
On 06/11/2013 04:04 PM, LC Bruzenak wrote:
I was playing with audit rules using keys with spaces.
Is the following expected (ignore the logic; was just testing the returns)?
# auditctl -l -k lsmod
LIST_RULES: exit,always watch=/sbin/lsmod perm=x key=lsmod kernel
LIST_RULES: exit,always watch=/bin/ping perm=x key=lsmod ping
Thx,
LCB
Sorry - forgot the version : audit-2.2-1.
Thx,
LCB
--
LC (Lenny) Bruzenak
lenny(a)magitekltd.com
On Tuesday, June 11, 2013 04:04:54 PM LC Bruzenak wrote:
I was playing with audit rules using keys with spaces.
Is the following expected (ignore the logic; was just testing the returns)?
# auditctl -l -k lsmod
LIST_RULES: exit,always watch=/sbin/lsmod perm=x key=lsmod kernel
LIST_RULES: exit,always watch=/bin/ping perm=x key=lsmod ping
What are you expecting? I can make it not accept keys with spaces. I don't
think putting spaces in keys is a good idea.
-Steve
Hey Steve,
I was expecting it to not match the one with the spaces.
I can live with any answer; either disallowing spaces or allowing spaces
and matching exactly, or (less desirable) even if it is desired to match
the first occurrence of the string and it is noted as such in the man page.
The reason I tried the spaces was at direction from a security guy who was
looking at a (now-mofied) RHEL 6 STIG beta release. I am not a fan of the
spaces myself; was probably going to substitute underscores.
Thanks,
LCB
On Wed, Jun 19, 2013 at 5:34 AM, Steve Grubb <sgrubb(a)redhat.com> wrote:
On Tuesday, June 11, 2013 04:04:54 PM LC Bruzenak wrote:
> I was playing with audit rules using keys with spaces.
> Is the following expected (ignore the logic; was just testing the
returns)?
>
> # auditctl -l -k lsmod
> LIST_RULES: exit,always watch=/sbin/lsmod perm=x key=lsmod kernel
> LIST_RULES: exit,always watch=/bin/ping perm=x key=lsmod ping
What are you expecting? I can make it not accept keys with spaces. I don't
think putting spaces in keys is a good idea.
-Steve
--
LC (Lenny) Bruzenak
lenny(a)magitekltd.com
4203
days inactive
4211
days old
linux-audit@lists.linux-audit.osci.io
3 comments
2 participants
tags (0)
participants (2)
-
LC Bruzenak -
Steve Grubb