Is the "possible" option used when checking a syscall filter rule?

Mounir Bsaibes mbsaibes at us.ibm.com
Mon Apr 25 19:08:09 UTC 2005


Does this option make sense when setting a  syscall entry filter or exit
filter? Or, it is meant just for task filtering? 

During task creation this option is checked. If true, the per-task
audit_context is created and always filled at syscall entry time.

What is the meaning (how it is used) of "possible" in the following
example:
auditctl -a entry,possible -S chmod  

	`




More information about the Linux-audit mailing list