Unable to filter on negative values

Dustin Kirkland dustin.kirkland at us.ibm.com
Tue Feb 14 19:14:46 UTC 2006


On Tue, 2006-02-14 at 13:17 -0500, Linda Knippers wrote:
> It seems to work with a rule like this:
> /sbin/auditctl -a exit,always -S pread64 -F success=no -F exit=9

Should we in userspace then translate something like
/sbin/auditctl -a exit,always -S pread64 -F exit=-9
to
/sbin/auditctl -a exit,always -S pread64 -F success=no -F exit=9


:-Dustin




More information about the Linux-audit mailing list