From mboxrd@z Thu Jan 1 00:00:00 1970 From: Matthew Booth Subject: -a task,always audits everything Date: Wed, 21 Feb 2007 11:14:26 +0000 Message-ID: <1172056466.3970.17.camel@localhost.localdomain> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============1311821776==" Return-path: Received: from [192.168.1.8] (sebastian-int.corp.redhat.com [172.16.52.221]) by pobox.surrey.redhat.com (8.12.11.20060308/8.12.11) with ESMTP id l1LIHkwK020394 for ; Wed, 21 Feb 2007 18:17:46 GMT List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit List-Id: linux-audit@redhat.com --===============1311821776== Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="=-dvktSr1Q78BBOutSkJjV" --=-dvktSr1Q78BBOutSkJjV Content-Type: text/plain Content-Transfer-Encoding: quoted-printable I added the following to audit.rules in RHEL4 U4 x86_64: -a task,always I expected this to have a similar effect to auditing the fork, vfork and clone system calls. However, it seems to either audit everything itself, or cause all the filtering to be removed from my other audit rules (which audit pretty much everything). Is this expected behaviour, or a bug? Thanks, Matt --=20 Red Hat, Global Professional Services M: +44 (0)7977 267231 GPG ID: D33C3490 GPG FPR: 3733 612D 2D05 5458 8A8A 1600 3441 EA19 D33C 3490 --=-dvktSr1Q78BBOutSkJjV Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iD4DBQBF3CmSNEHqGdM8NJARAmt+AJjx7dHAyHieVdHjKzwZcysedh8HAJ9KYCPm bGRG8Ve+WYefzPcaAyCkSg== =fKgF -----END PGP SIGNATURE----- --=-dvktSr1Q78BBOutSkJjV-- --===============1311821776== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============1311821776==--