test patch for auditctl inter-field comparisons on euid/uid, egid/gid

Peter Moody pmoody at google.com
Thu Dec 15 00:16:01 UTC 2011


On Tue, Dec 13, 2011 at 5:38 PM, Peter Moody <pmoody at google.com> wrote:
> Here's the updated version, now supporting all of the interfield
> comparisons from
> https://www.redhat.com/archives/linux-audit/2011-December/msg00018.html
>
> auditctl -l doesn't report the comparison filters correctly. I'll look
> more into this.

Testing has revealed a couple of bugs in this. Fixing these and
testing some more now.

Cheers,
peter

-- 
Peter Moody      Google    1.650.253.7306
Security Engineer  pgp:0xC3410038




More information about the Linux-audit mailing list