From mboxrd@z Thu Jan  1 00:00:00 1970
From: Michael C Thompson <thompsmc@us.ibm.com>
Subject: exclude's effect with multiple rules
Date: Fri, 25 Aug 2006 17:04:41 -0500
Message-ID: <44EF73F9.1010700@us.ibm.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
Received: from mx1.redhat.com (mx1.redhat.com [172.16.48.31])
	by int-mx1.corp.redhat.com (8.12.11.20060308/8.12.11) with ESMTP id
	k7PM54Og027494
	for <linux-audit@redhat.com>; Fri, 25 Aug 2006 18:05:04 -0400
Received: from e1.ny.us.ibm.com (e1.ny.us.ibm.com [32.97.182.141])
	by mx1.redhat.com (8.12.11.20060308/8.12.11) with ESMTP id
	k7PM529r006124
	for <linux-audit@redhat.com>; Fri, 25 Aug 2006 18:05:02 -0400
Received: from d01relay04.pok.ibm.com (d01relay04.pok.ibm.com [9.56.227.236])
	by e1.ny.us.ibm.com (8.13.8/8.12.11) with ESMTP id k7PM4qLl003878
	for <linux-audit@redhat.com>; Fri, 25 Aug 2006 18:04:52 -0400
Received: from d01av02.pok.ibm.com (d01av02.pok.ibm.com [9.56.224.216])
	by d01relay04.pok.ibm.com (8.13.6/8.13.6/NCO v8.1.1) with ESMTP id
	k7PM4qWr227838
	for <linux-audit@redhat.com>; Fri, 25 Aug 2006 18:04:52 -0400
Received: from d01av02.pok.ibm.com (loopback [127.0.0.1])
	by d01av02.pok.ibm.com (8.12.11.20060308/8.13.3) with ESMTP id
	k7PM4qdP023684
	for <linux-audit@redhat.com>; Fri, 25 Aug 2006 18:04:52 -0400
Received: from [127.0.0.1] (pendarric.austin.ibm.com [9.41.46.113])
	by d01av02.pok.ibm.com (8.12.11.20060308/8.12.11) with ESMTP id
	k7PM4pdn023626
	for <linux-audit@redhat.com>; Fri, 25 Aug 2006 18:04:52 -0400
List-Unsubscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: Linux Audit <linux-audit@redhat.com>
List-Id: linux-audit@redhat.com

Hey all,

So if I have the following two rules, what should be expected behaviour?

auditctl -a entry,always -S chmod
auditctl -a exclude,always -S all

... Assume we can change the ordering.

Thanks,
Mike