From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Ameel Kamboh" Subject: Exclusion with recursive watch Date: Thu, 19 Feb 2009 10:30:05 -0500 Message-ID: <4620668FFAA3D5458A691287D9DDAD11014C81ED@zrtphxm2.corp.nortel.com> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============0969378251==" Return-path: Received: from mx1.redhat.com (mx1.redhat.com [172.16.48.31]) by int-mx1.corp.redhat.com (8.13.1/8.13.1) with ESMTP id n1JFUR5Q000812 for ; Thu, 19 Feb 2009 10:30:27 -0500 Received: from zrtps0kp.nortel.com (zrtps0kp.nortel.com [47.140.192.56]) by mx1.redhat.com (8.13.8/8.13.8) with ESMTP id n1JFUEuu028122 for ; Thu, 19 Feb 2009 10:30:14 -0500 Received: from zrtphxm2.corp.nortel.com (zrtphxm2.corp.nortel.com [47.140.202.51]) by zrtps0kp.nortel.com (Switch-2.2.6/Switch-2.2.0) with ESMTP id n1JFUB014421 for ; Thu, 19 Feb 2009 15:30:11 GMT Content-class: urn:content-classes:message List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com This is a multi-part message in MIME format. --===============0969378251== Content-class: urn:content-classes:message Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C992A6.F08AC1B8" This is a multi-part message in MIME format. ------_=_NextPart_001_01C992A6.F08AC1B8 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: quoted-printable I am currently using audit-1.6.5-9.el5. I have watch rules that look for modifications to directory content, example: -w /etc -p aw I would like to add an exception not to watch "/etc/mydir". I know that audit 1.6 will watch /etc and all subdirs within that. Is there a way I can add this exception? Thanks Ameel ------_=_NextPart_001_01C992A6.F08AC1B8 Content-Type: text/html; charset="US-ASCII" Content-Transfer-Encoding: quoted-printable Exclusion with recursive watch

I am currently using = audit-1.6.5-9.el5.
I have watch rules that look for = modifications to directory content, example:

    -w  /etc -p = aw

I would like to add an exception not to = watch "/etc/mydir".
I know that audit 1.6 will watch /etc = and all subdirs within that.
Is there a way I can add this = exception?

Thanks
Ameel

------_=_NextPart_001_01C992A6.F08AC1B8-- --===============0969378251== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============0969378251==-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: Exclusion with recursive watch Date: Thu, 19 Feb 2009 13:43:11 -0500 Message-ID: <200902191343.11497.sgrubb@redhat.com> References: <4620668FFAA3D5458A691287D9DDAD11014C81ED@zrtphxm2.corp.nortel.com> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <4620668FFAA3D5458A691287D9DDAD11014C81ED@zrtphxm2.corp.nortel.com> Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Thursday 19 February 2009 10:30:05 am Ameel Kamboh wrote: > -w /etc -p aw > > I would like to add an exception not to watch "/etc/mydir". > I know that audit 1.6 will watch /etc and all subdirs within that. > Is there a way I can add this exception? Not today. That is a kernel issue. Al corrected this in a patch that should have landed in the 2.6.29 kernel. I believe this will also be fixed in the next RHEL kernel. -Steve