From: LC Bruzenak <lenny@magitekltd.com>
To: linux-audit@redhat.com
Subject: Re: need rules help - solved
Date: Thu, 06 Aug 2009 10:10:30 -0500 [thread overview]
Message-ID: <1249571430.12117.1002.camel@homeserver> (raw)
In-Reply-To: <1249526745.12117.986.camel@homeserver>
On Wed, 2009-08-05 at 21:45 -0500, LC Bruzenak wrote:
>
> I thought that the following would work:
> -a never,exit -F subj_type=jcdx_mtdb_t -F obj_type=jcdx_stdb_var_t
Sorry for the false alarm. This one is operator error (at least I think
it is; will retest better, so far it appears to work as advertised).
I realized I had a rule to audit that event in the list.
This one needs the "-A' vice "-a" to ensure it goes to the head of the
rule line.
LCB.
--
LC (Lenny) Bruzenak
lenny@magitekltd.com
next prev parent reply other threads:[~2009-08-06 15:10 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2009-08-06 2:45 need rules help LC Bruzenak
2009-08-06 15:10 ` LC Bruzenak [this message]
2009-08-06 21:17 ` LC Bruzenak
2009-08-08 2:23 ` LC Bruzenak
2009-08-08 15:34 ` Steve Grubb
2009-08-08 17:59 ` LC Bruzenak
2009-08-09 13:37 ` Steve Grubb
2009-08-09 15:10 ` LC Bruzenak
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1249571430.12117.1002.camel@homeserver \
--to=lenny@magitekltd.com \
--cc=linux-audit@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox