- First Post
- Replies
- Stats
-
Go to
- ----- 2024 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2023 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2022 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2021 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2020 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2019 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2018 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2017 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2016 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2015 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2014 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2013 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2012 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2011 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2010 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2009 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2008 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2007 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2006 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2005 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2004 -----
- December
- November
- October
- September
- August
Hi,
What's the difference between -F dir=XX and -w?
-a exit,always -F arch=b64 -S open -F success=1 -F dir=/secure
versus
-w /secure
--
Best Regards,
Aaron Lewis - PGP: 0x13714D33 - http://pgp.mit.edu/
Finger Print: 9F67 391B B770 8FF6 99DC D92D 87F6 2602 1371 4D33
Hi Aaron,
On Jan 3, 2014, at 12:30 AM, Aaron Lewis <the.warl0ck.1989(a)gmail.com> wrote:
Hi,
What's the difference between -F dir=XX and -w?
-a exit,always -F arch=b64 -S open -F success=1 -F dir=/secure
versus
-w /secure
I'm new to audit but I did a search and after a while found an old thread. I
think -w /path is essentially expanded to be -F dir=/path rule except they don't put
the -F arch=b64. I guess architecture may not matter for open() but that's just a
guess.
Here it is,
https://www.redhat.com/archives/linux-audit/2013-September/msg00057.html
V/r,
Bryan
On Fri, 3 Jan 2014 14:30:58 +0800
Aaron Lewis <the.warl0ck.1989(a)gmail.com> wrote:
What's the difference between -F dir=XX and -w?
-a exit,always -F arch=b64 -S open -F success=1 -F dir=/secure
versus
-w /secure
The '-w' option is for backwards compatibility with the original
(RHEL4) implementation. What it does it detect what the target is (file
or dir) and then expands into -F path= or -F dir= depending on what the
target was. '-w' should be considered deprecated and is limited in its
capabilities. This is explained in more detail on the auditctl man page.
-Steve
4005
days inactive
4005
days old
linux-audit@lists.linux-audit.osci.io
2 comments
3 participants
tags (0)
participants (3)
-
Aaron Lewis -
Bryan Harris -
Steve Grubb