[RFC] NISPOM audit rules - first draft

[Steve Grubb]

On Friday 13 April 2007 14:24, Timothy R. Chavez wrote:
> Wow... finally just getting to these.  Just a couple quick comments below.

The nispom.rules file has been updated several times since this was initially 
posted.

> > ## unsuccessful modifications
> > -a exit,always -S rename -S truncate -S ftruncate -F exit=-13 -k mods
> > -a exit,always -S renameat -F exit=-13 -k mods
> > -a exit,always -F perm=a -F exit=-13 -k mods
>
> No system call specified...

That's what the magic of "perm" is. It selects all syscalls that match the 
changing of attribute.

-Steve