From mboxrd@z Thu Jan  1 00:00:00 1970
From: Richard Guy Briggs <rgb@redhat.com>
Subject: Re: Auditing file access by application
Date: Mon, 12 Jun 2017 11:49:36 -0400
Message-ID: <20170612154936.GF21241@madcap2.tricolour.ca>
References: <CAD4AmV6KfUhM_N7fM6cHW+LF271G_TQiE5JYRmerw9JgzMMy2g@mail.gmail.com>
	<20170612150504.GE21241@madcap2.tricolour.ca>
	<CAD4AmV6mYq_JJMoreD8pAtY0pariPO7WxiBCzKW+3ZQoYGsYoA@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
Content-Disposition: inline
In-Reply-To: <CAD4AmV6mYq_JJMoreD8pAtY0pariPO7WxiBCzKW+3ZQoYGsYoA@mail.gmail.com>
List-Unsubscribe: <https://www.redhat.com/mailman/options/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: John Petrini <jpetrini@coredial.com>
Cc: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

On 2017-06-12 11:31, John Petrini wrote:
> Hi Richard.
> 
> It looks like the -F exe= option is not supported at all regardless of
> negation.
> 
> Starting auditd:                                           [  OK  ]
> -F unknown field: exe

Support is upstream in Linux kernel v4.3 and userspace audit-2.5.0.
It is in RHEL7 kernel-3.10.0-351.el7

> John Petrini

- RGB

--
Richard Guy Briggs <rgb@redhat.com>
Sr. S/W Engineer, Kernel Security, Base Operating Systems
Remote, Ottawa, Red Hat Canada
IRC: rgb, SunRaycer
Voice: +1.647.777.2635, Internal: (81) 32635