From mboxrd@z Thu Jan  1 00:00:00 1970
From: Steve Grubb <sgrubb@redhat.com>
Subject: Re: [RFC] Virtual Key Fields
Date: Mon, 24 Mar 2008 09:52:28 -0400
Message-ID: <200803240952.28242.sgrubb@redhat.com>
References: <200803240927.35073.sgrubb@redhat.com>
	<1206366134.3192.14.camel@localhost.localdomain>
Mime-Version: 1.0
Content-Type: text/plain;
  charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Return-path: <linux-audit-bounces@redhat.com>
In-Reply-To: <1206366134.3192.14.camel@localhost.localdomain>
Content-Disposition: inline
List-Unsubscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: Eric Paris <eparis@redhat.com>
Cc: Linux Audit <linux-audit@redhat.com>
List-Id: linux-audit@redhat.com

On Monday 24 March 2008 09:42:14 Eric Paris wrote:
> > Auditctl will also allow delete all rules matching a key. This will a=
llow
> > the admin or a program to delete a set of rules related to just a
> > particular key and leave all other rules intact.
>
> How does this work? =C2=A0This is a completely new concept and it seems=
 like
> it should be a second patch after you have multiple keys in to start
> with.

This is all in user space so no kernel changes are needed.


> auditctl -a exit,always -w /tmp/file1 -k file1 -k shared-key
> auditctl -a exit,always -w /tmp/file2 -k file2 -k shared-key
>
> now if I say (and i'm just guessing your new syntax):
>
> auditctl -d -k shared-key

I was only going to change the '-D' option (delete all). Assuming this wa=
s=20
typed:

auditctl -D -k shared-key

You have no rules left which is the same as if you did not have the -k ad=
ded.=20
If however, you have this loaded:

-a exit,always -w /tmp/file1 -k file1 -k my-file-key -k ids-file-high
-a exit,always -w /tmp/file2 -k file2 -k another-key -k ids-file-high

auditctl -D -k another-key

will just delete the second rule.

auditctl -D -k ids-file-high

will delete them all.

-Steve