key options with spaces

[LC Bruzenak]

Hey Steve,

I was expecting it to not match the one with the spaces.
I can live with any answer; either disallowing spaces or allowing spaces
and matching exactly, or (less desirable) even if it is desired to match
the first occurrence of the string and it is noted as such in the man page.

The reason I tried the spaces was at direction from a security guy who was
looking at a (now-mofied) RHEL 6 STIG beta release. I am not a fan of the
spaces myself; was probably going to substitute underscores.

Thanks,
LCB


On Wed, Jun 19, 2013 at 5:34 AM, Steve Grubb <sgrubb at redhat.com> wrote:

> On Tuesday, June 11, 2013 04:04:54 PM LC Bruzenak wrote:
> > I was playing with audit rules using keys with spaces.
> > Is the following expected (ignore the logic; was just testing the
> returns)?
> >
> > # auditctl -l -k lsmod
> > LIST_RULES: exit,always watch=/sbin/lsmod perm=x key=lsmod kernel
> > LIST_RULES: exit,always watch=/bin/ping perm=x key=lsmod ping
>
> What are you expecting? I can make it not accept keys with spaces. I don't
> think putting spaces in keys is a good idea.
>
> -Steve
>



-- 

LC (Lenny) Bruzenak
lenny at magitekltd.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20130619/9e7c2973/attachment.htm>