Multiple Rule Logic
Steve Grubb
sgrubb at redhat.com
Tue May 16 21:46:31 UTC 2006
On Tuesday 16 May 2006 16:13, Michael C Thompson wrote:
> I was wondering what is to be expected when multiple rules exist that
> pertain to the same action.
You have to consider the lists that they are on. Each list is evaluated from
first to last. Any event that is created is sent to the exclude filter for
potential action.
> Examples:
> entry,always -S chmod - should see a record for chmod
> exclude,always -S all - should never see any sys calls
>
> Combined, should I expect a chmod record?
Yes. The exclude filter only removes records by message type.
exclude,always -F msgtype=SYSCALL
would be a valid use of it.
> From my experiments with the current code, if any one rule instructs
> audit to log the action, auditd will log it (i.e. I'll see a chmod
> record). I'm wondering if this is the intended functionality.
I suspect we should have an error when you try to load a rule like in you
example.
-Steve
More information about the Linux-audit
mailing list