[Fwd: Re: Rules order]

Loredan Stancu loredan.stancu at myclar.ro
Tue Dec 9 17:05:07 UTC 2008


On Monday 08 December 2008 05:11:45 pm you wrote:
> As you can see rule with 'never' action is first introduced but in exit
> table they are in reverse order.

Anything with a path or dir in it actually winds up on a hidden filter inside
the audit system. It runs from the exit filter, but it is distinct. I am
asking Al Viro what his thoughts are about this. This would have been a good
email for the mail list so that everyone can see Al's response.

-Steve




More information about the Linux-audit mailing list