From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: Excluding the single executable on the top of audit.rules Date: Tue, 19 Aug 2014 16:32:55 -0400 Message-ID: <1846709.GW3lW58yy4@x2> References: <69303615BE133645963548DD4A3BFCB3DC4EE3@E2K7.fintech.ru> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Return-path: In-Reply-To: <69303615BE133645963548DD4A3BFCB3DC4EE3@E2K7.fintech.ru> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com Cc: =?utf-8?B?0JjRgdCw0LXQsiDQktC40YLQsNC70LjQuSDQkNC90LDRgtC+0LvRjNC10LLQuNGH?= List-Id: linux-audit@redhat.com SGVsbG8sCgpPbiBUdWVzZGF5LCBBdWd1c3QgMTksIDIwMTQgMTE6MDc6MTggQU0g0JjRgdCw0LXQ siDQktC40YLQsNC70LjQuSDQkNC90LDRgtC+0LvRjNC10LLQuNGHIHdyb3RlOgo+IEkgd291bGQg bGlrZSB0byBhc2sgZm9yIGFuIGV4cGxhbmF0aW9uIGFib3V0IG1ha2luZyBteSBhdWRpdC5ydWxl cyBwcm9wZXIuCj4gV2hhdCBhbSBJIHRyeWluZyB0byBkbyBpcyB0byBleGNsdWRlIGFsbCB0aGUg c3lzY2FsbCBldmVudHMgY29taW5nIGZyb20KPiBleGU9Ii91c3IvYmluL3B1bHNlYXVkaW8iIGFu ZCBpdHMgY29tcG9uZW50cy4gQXQgdGhlIG1vbWVudCBhYm91dCA5NSUgb2YKPiBhdWRpdCBsb2cg aXMgZmlsbGVkIHdpdGggbWVzc2FnZXMgcmVsYXRlZCB0byBwdWxzZWF1ZGlvOgo+IAo+ICMgYXVy ZXBvcnQgLXggLWlmIG15LmxvZyAtLXN1bW1hcnkKPiBFeGVjdXRhYmxlIFN1bW1hcnkgUmVwb3J0 Cj4gPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Cj4gdG90YWwgIGZpbGUKPiA9PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KPiAxMTU2OTIzICAvdXNyL2Jpbi9wdWxzZWF1 ZGlvCgpJIHdvdWxkIGJlIGN1cmlvdXMgd2hpY2ggcnVsZSB5b3UgYXJlIGdldHRpbmcgaGl0IHdp dGguIE5vcm1hbGx5LCB5b3UgZGVzaWduIAp0aGUgcnVsZXMgc28gdGhhdCBhIHByb3Blcmx5IHJ1 bm5pbmcgc3lzdGVtIGRvZXMgbm90IGNhdXNlIGV2ZW50cy4gVGhpcyBtZWFucyAKcXVhbGlmeWlu ZyB0aGUgcnVsZXMgd2l0aCBzb21ldGhpbmcgbGlrZSBFUEVSTSBvciBFQUNDRVMgc28gdGhhdCB5 b3Ugb25seSBsb2cgCnJlYWwgcHJvYmxlbXMgYW5kIG5vdCBub3JtYWwgc3lzdGVtIG9wZXJhdGlv bi4gVGhhdCBzYWlkLCBhdCB0aGUgbW9tZW50LCB0aGUgCmJlc3Qgd2F5IHRvIHJlbW92ZSBhIHNp bmdsZSBwcm9jZXNzIGlzIHRvIHVzZSBzZWxpbnV4IHR5cGVzIGluIHRoZSBhdWRpdCAKZXZlbnQu IEhvd2V2ZXIsIHRoaXMgdHJpY2sgZG9lcyBub3Qgd29yayBpbiB0aGlzIGNhc2UgYmVjYXVzZSBw dWxzZWF1ZGlvIGhhcyAKbm8gU0UgTGludXggcG9saWN5LiBZb3Ugd291bGQgYWxtb3N0IHdhbnQg dG8gZ2l2ZSBpdCBhIHR5cGUgdGhhdCBtYXBzIHRvIAp1bmNvbmZpbmVkX3QuIFRoZW4geW91IGNv dWxkIHdyaXRlIGEgcnVsZSBsaWtlOgoKLWEgZXhpdCxuZXZlciAtUyBhbGwgLUYgc3Vial90eXBl PXB1bHNlYXVkaW9fdAoKWW91IHdvdWxkIHBsYWNlIHRoYXQgYXQgdGhlIHRvcCBvZiB0aGUgcnVs ZXMgc28gaXQgbWF0Y2hlcyBmaXJzdC4gVGhlcmUgd2FzIAp3b3JrIGdvaW5nIG9uIHRvIG1hdGNo IGFnYWluc3QgYW4gZXhlY3V0YWJsZSBuYW1lLiBCdXQgSSBoYXZlbid0IHNlZW4gYW55IApwcm9n cmVzcyBpbiBhIGxvbmcgdGltZS4gSWYgdGhhdCB3ZXJlIGZpbmlzaGVkLCBpdCB3b3VsZCBzb2x2 ZSB5b3VyIHByb2JsZW0uCgotU3RldmUKCgo+IDE5MTcxOSAgL3Vzci9saWJleGVjL3B1bHNlL2dj b25mLWhlbHBlcgo+IDQ5MjgyICAvdXNyL2Jpbi9nbm9tZS12b2x1bWUtY29udHJvbC1hcHBsZXQK PiA4MDM1ICAvdXNyL2xpYmV4ZWMvZ25vbWUtc2V0dGluZ3MtZGFlbW9uCj4gMTA0NSAgL3Vzci9z YmluL2Nyb25kCj4gMjY1ICAvdXNyL2Jpbi9uYXV0aWx1cwo+IDIzICAvdXNyL3NiaW4vc3NoZAo+ IAo+IFBsZWFzZSBsb29rIHRocm91Z2ggdGhlIGN1cnJlbnQgdmVyc2lvbiBvZiBhdWRpdC5ydWxl cy4gSG93IHNob3VsZCBJIG1vZGlmeQo+IHRoZW0/Cj4gCj4gIyBGaXJzdCBydWxlIC0gZGVsZXRl IGFsbAo+IC1ECj4gCj4gIyBJbmNyZWFzZSB0aGUgYnVmZmVycyB0byBzdXJ2aXZlIHN0cmVzcyBl dmVudHMuCj4gIyBNYWtlIHRoaXMgYmlnZ2VyIGZvciBidXN5IHN5c3RlbXMKPiAtYiAzMjAKPiAK PiAjIEZlZWwgZnJlZSB0byBhZGQgYmVsb3cgdGhpcyBsaW5lLiBTZWUgYXVkaXRjdGwgbWFuIHBh Z2UKPiAjLWEgZXhpdCxuZXZlciAtRiBleGU9L3Vzci9iaW4vcHVsc2VhdWRpbyAtUyBvcGVuCj4g LWEgZXhpdCxhbHdheXMgLUYgYXJjaD14ODZfNjQgLUYgdWlkPj01MDAgLUYgZ2lkPj01MDAgLUYg cHBpZCE9MSAtRgo+IGF1aWQhPTQyOTQ5NjcyOSAtUyBvcGVuIC1hIGV4aXQsYWx3YXlzIC1GIGFy Y2g9eDg2XzY0IC1GIHVpZD49NTAwIC1GCj4gZ2lkPj01MDAgLUYgcHBpZCE9MSAtRiBhdWlkIT00 Mjk0OTY3MjkgLVMgZXhlY3ZlIC1hIGV4aXQsYWx3YXlzIC1GCj4gYXJjaD14ODZfNjQgLUYgdWlk Pj01MDAgLUYgZ2lkPj01MDAgLUYgcHBpZCE9MSAtRiBhdWlkIT00Mjk0OTY3MjkgLVMgZm9yawo+ IC1hIGV4aXQsYWx3YXlzIC1GIGFyY2g9eDg2XzY0IC1GIHVpZD49NTAwIC1GIGdpZD49NTAwIC1G IHBwaWQhPTEgLUYKPiBhdWlkIT00Mjk0OTY3MjkgLVMgdmZvcmsgLWEgZXhpdCxhbHdheXMgLUYg YXJjaD14ODZfNjQgLUYgdWlkPj01MDAgLUYKPiBnaWQ+PTUwMCAtRiBwcGlkIT0xIC1GIGF1aWQh PTQyOTQ5NjcyOSAtUyBleGl0IC1hIGV4aXQsYWx3YXlzIC1GCj4gYXJjaD14ODZfNjQgLUYgdWlk Pj01MDAgLUYgZ2lkPj01MDAgLUYgcHBpZCE9MSAtRiBhdWlkIT00Mjk0OTY3MjkgLVMKPiBleGl0 X2dyb3VwIC1hIGV4aXQsYWx3YXlzIC1GIGFyY2g9eDg2XzY0IC1GIHVpZD49NTAwIC1GIGdpZD49 NTAwIC1GIHBwaWQhPTEKPiAtRiBhdWlkIT00Mjk0OTY3MjkgLVMgZ2V0ZGVudHMgLWEgZXhpdCxh bHdheXMgLUYgYXJjaD14ODZfNjQgLUYgdWlkPj01MDAgLUYKPiBnaWQ+PTUwMCAtRiBwcGlkIT0x IC1GIGF1aWQhPTQyOTQ5NjcyOSAtUyBjaG1vZCAtYSBleGl0LGFsd2F5cyAtRgo+IGFyY2g9eDg2 XzY0IC1GIHVpZD49NTAwIC1GIGdpZD49NTAwIC1GIHBwaWQhPTEgLUYgYXVpZCE9NDI5NDk2NzI5 IC1TIGZjaG1vZAo+IC1hIGV4aXQsYWx3YXlzIC1GIGFyY2g9eDg2XzY0IC1GIHVpZD49NTAwIC1G IGdpZD49NTAwIC1GIHBwaWQhPTEgLUYKPiBhdWlkIT00Mjk0OTY3MjkgLVMgZmNobW9kYXQgLWEg ZXhpdCxhbHdheXMgLUYgYXJjaD14ODZfNjQgLUYgdWlkPj01MDAgLUYKPiBnaWQ+PTUwMCAtRiBw cGlkIT0xIC1GIGF1aWQhPTQyOTQ5NjcyOSAtUyBjaG93biAtYSBleGl0LGFsd2F5cyAtRgo+IGFy Y2g9eDg2XzY0IC1GIHVpZD49NTAwIC1GIGdpZD49NTAwIC1GIHBwaWQhPTEgLUYgYXVpZCE9NDI5 NDk2NzI5IC1TIGZjaG93bgo+IC1hIGV4aXQsYWx3YXlzIC1GIGFyY2g9eDg2XzY0IC1GIHVpZD49 NTAwIC1GIGdpZD49NTAwIC1GIHBwaWQhPTEgLUYKPiBhdWlkIT00Mjk0OTY3MjkgLVMgbGNob3du IC1hIGV4aXQsYWx3YXlzIC1GIGFyY2g9eDg2XzY0IC1GIHVpZD49NTAwIC1GCj4gZ2lkPj01MDAg LUYgcHBpZCE9MSAtRiBhdWlkIT00Mjk0OTY3MjkgLVMgZmNob3duYXQgLWEgZXhpdCxhbHdheXMg LUYKPiBhcmNoPXg4Nl82NCAtRiB1aWQ+PTUwMCAtRiBnaWQ+PTUwMCAtRiBwcGlkIT0xIC1GIGF1 aWQhPTQyOTQ5NjcyOSAtUyB1bmxpbmsKPiAtYSBleGl0LGFsd2F5cyAtRiBhcmNoPXg4Nl82NCAt RiB1aWQ+PTUwMCAtRiBnaWQ+PTUwMCAtRiBwcGlkIT0xIC1GCj4gYXVpZCE9NDI5NDk2NzI5IC1T IHVubGlua2F0Cj4gCj4gUC5TLiBXZSdyZSB1c2luZyBSSEVMIDYuNCB3aXRoIGF1ZGl0LTIuMi0y LmVsNi54ODZfNjQuCj4gCj4gU2luY2VyZWx5LAo+IFZpdGFseSBJc2Fldgo+IFNvZnR3YXJlIGVu Z2luZWVyCj4gSW5mb3JtYXRpb24gc2VjdXJpdHkgZGVwYXJ0bWVudAo+IEZpbnRlY2ggSlNDLCBN b3Njb3csIFJ1c3NpYQoKCi0tCkxpbnV4LWF1ZGl0IG1haWxpbmcgbGlzdApMaW51eC1hdWRpdEBy ZWRoYXQuY29tCmh0dHBzOi8vd3d3LnJlZGhhdC5jb20vbWFpbG1hbi9saXN0aW5mby9saW51eC1h dWRpdA==