Is the "possible" option used when checking a syscall filter rule?
Mounir Bsaibes
mbsaibes at us.ibm.com
Mon Apr 25 19:08:09 UTC 2005
Does this option make sense when setting a syscall entry filter or exit
filter? Or, it is meant just for task filtering?
During task creation this option is checked. If true, the per-task
audit_context is created and always filled at syscall entry time.
What is the meaning (how it is used) of "possible" in the following
example:
auditctl -a entry,possible -S chmod
`
More information about the Linux-audit
mailing list