audit rule question

Steve Grubb sgrubb at redhat.com
Wed May 7 18:37:13 UTC 2008


On Wednesday 07 May 2008 12:56:37 LC Bruzenak wrote:
> > I'd say we need to fix the man page.
>
> OK. Should I open a bz?

I put it in the TODO list for 1.7.3. So, it is being tracked. You can open a 
bz if you want to.


> I am a little surprised that the "-a always,exit" doesn't cause an
> error. I wonder if it works correctly - maybe auditctl code is smart
> enough to overcome syntactic dyslexia? :)

I was always mixing up the order when writing rules, so I fixed auditctl to 
take it in either order. Its been like this for 3-4 years.

-Steve




More information about the Linux-audit mailing list