From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: audit watch rules and docker containers Date: Sun, 4 Mar 2018 14:00:43 +0100 Message-ID: <20180304140043.718c3a58@ivy-bridge> References: <2039210969.8919376.1520042001277.ref@mail.yahoo.com> <2039210969.8919376.1520042001277@mail.yahoo.com> <1702143807.8978259.1520067124126@mail.yahoo.com> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Return-path: In-Reply-To: <1702143807.8978259.1520067124126@mail.yahoo.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Rakesh Cc: "linux-audit@redhat.com" List-Id: linux-audit@redhat.com T24gU2F0LCAzIE1hciAyMDE4IDA4OjUyOjA0ICswMDAwIChVVEMpClJha2VzaCA8cmFrc2FjQHlh aG9vLmNvbT4gd3JvdGU6Cgo+IEhlbGxvIEF1ZGl0ZCdlcnMsCj4gCj4gCj4gCj4gSSBhbSBydW5u aW5nIGEgcHJpdmlsZWdlZCBjb250YWluZXIgd2l0aCBwaWQsIG5ldCwgdXRzIHNwYWNlIHNoYXJl ZAo+IHdpdGggdGhlIGhvc3QuIFRoZSBuZWVkIGlzIHRvIGJlIGFibGUgdG8gc2V0IGZpbGUgd2F0 Y2ggcnVsZXMgZnJvbQo+IHRoZSBjb250YWluZXIgc2F5IC1rIC9ldGMgLXAgcncgLWsgY29udGFp bnRlcl9ydWxlIGFuZCB0aGVuIGxvb2sgZm9yCj4gcmVhZC93cml0ZSBhY2Nlc3MgdG8gZmlsZXMv ZGlyZWN0b3JpZXMgaW4gL3Zhci9sb2cvYXVkaXQvKi4KCkNvbnRhaW5lciBzdXBwb3J0IGlzIGp1 c3Qgbm93IGJlaW5nIGltcGxlbWVudGVkLgoKaHR0cHM6Ly93d3cucmVkaGF0LmNvbS9hcmNoaXZl cy9saW51eC1hdWRpdC8yMDE4LU1hcmNoL21zZzAwMDA0Lmh0bWwKClNvLCB0aGVyZSBpcyBubyBn b29kIHdheSByaWdodCBub3cgdG8gbWFrZSB0aGlzIHdvcmsgbGlrZSB5b3Ugd291bGQKZXhwZWN0 IGl0LgoKLVN0ZXZlCgo+IFdoYXQgSSBhbQo+IGZpbmRpbmcgaXMgdGhlcmUgYXJlIG5vIHdhdGNo IGV2ZW50cyBiZWluZyBsb2dnZWQgSWYgSSBzZXQgdGhlIHNhbWUKPiBhdWRpdCB3YXRjaCBydWxl IGZyb20gdGhlIGhvc3QgKGFuZCBub3QgYmVpbmcgaW4gdGhlIHByaXZpbGVnZWQKPiBjb250YWlu ZXIpIEkgYW0gYWJsZSB0byBnZXQgYXVkaXQgZXZlbnRzIFVzaW5nIG5zZW50ZXIgdG8gc3dpdGNo Cj4gbmFtZXNwYWNlIChuc2VudGVyIC10IDEgYXVkaXRjdGzCoC1rIC9ldGMgLXAgcncgLWsgY29u dGFpbnRlcl9ydWxlKQo+IGRvZXMgbm90IGhlbHAgZWl0aGVyIEkgc3VzcGVjdCB0aGUgbW50IG5h bWVzcGFjZSBpcyBkaWZmZXJlbnQgd2hpY2gKPiBpcyBjYXVzaW5nIHRoaXMgb2RkaXR5IGluIGJl aGF2aW9yIGxvb2tpbmcgYXQgY29udGFpbmVyIHByb2Nlc3MKPiBuYW1lc3BhY2UgLSB0ZXN0QHVi dW50dS0xNjp+L2F1ZGl0JCBzdWRvIGxzCj4gLWxhdHLCoCAvcHJvYy8yNjA1MC9uc1tzdWRvXSBw YXNzd29yZCBmb3IgdGVzdDp0b3RhbCAwZHIteHIteHIteCA5Cj4gcm9vdCByb290IDAgTWFywqAg MiAxNjo1OCAuLmRyLXgtLXgtLXggMiByb290IHJvb3QgMCBNYXLCoCAyCj4gMTc6NDYgLmxyd3hy d3hyd3ggMSByb290IHJvb3QgMCBNYXLCoCAyIDE3OjQ2IHV0cyAtPgo+IHV0czpbNDAyNjUzMTgz OF1scnd4cnd4cnd4IDEgcm9vdCByb290IDAgTWFywqAgMiAxNzo0NiB1c2VyIC0+Cj4gdXNlcjpb NDAyNjUzMTgzN11scnd4cnd4cnd4IDEgcm9vdCByb290IDAgTWFywqAgMiAxNzo0NiBwaWQgLT4K PiBwaWQ6WzQwMjY1MzE4MzZdbHJ3eHJ3eHJ3eCAxIHJvb3Qgcm9vdCAwIE1hcsKgIDIgMTc6NDYg bmV0IC0+Cj4gbmV0Ols0MDI2NTMxOTU3XWxyd3hyd3hyd3ggMSByb290IHJvb3QgMCBNYXLCoCAy IDE3OjQ2IG1udCAtPgo+IG1udDpbNDAyNjUzMjUxN11scnd4cnd4cnd4IDEgcm9vdCByb290IDAg TWFywqAgMiAxNzo0NiBpcGMgLT4KPiBpcGM6WzQwMjY1MzI1MThdbHJ3eHJ3eHJ3eCAxIHJvb3Qg cm9vdCAwIE1hcsKgIDIgMTc6NDYgY2dyb3VwIC0+Cj4gY2dyb3VwOls0MDI2NTMxODM1XSBsb29r aW5nIGF0IGluaXQgcHJvY2VzcyBuYW1lc3BhY2UgLQo+IAo+IHRlc3RAdWJ1bnR1LTE2On4vYXVk aXQkIHN1ZG8gbHMgLWxhdHLCoCAvcHJvYy8xL25zdG90YWwgMGRyLXhyLXhyLXggOQo+IHJvb3Qg cm9vdCAwIE1hcsKgIDIgMTA6MzcgLi5scnd4cnd4cnd4IDEgcm9vdCByb290IDAgTWFywqAgMiAx MDozOCBtbnQKPiAtPiBtbnQ6WzQwMjY1MzE4NDBdZHIteC0teC0teCAyIHJvb3Qgcm9vdCAwIE1h csKgIDIgMTA6MzggLmxyd3hyd3hyd3gKPiAxIHJvb3Qgcm9vdCAwIE1hcsKgIDIgMTY6NDcgdXRz IC0+IHV0czpbNDAyNjUzMTgzOF1scnd4cnd4cnd4IDEgcm9vdAo+IHJvb3QgMCBNYXLCoCAyIDE2 OjQ3IHVzZXIgLT4gdXNlcjpbNDAyNjUzMTgzN11scnd4cnd4cnd4IDEgcm9vdCByb290IDAKPiBN YXLCoCAyIDE2OjQ3IHBpZCAtPiBwaWQ6WzQwMjY1MzE4MzZdbHJ3eHJ3eHJ3eCAxIHJvb3Qgcm9v dCAwIE1hcsKgIDIKPiAxNjo0NyBuZXQgLT4gbmV0Ols0MDI2NTMxOTU3XWxyd3hyd3hyd3ggMSBy b290IHJvb3QgMCBNYXLCoCAyIDE2OjQ3Cj4gaXBjIC0+IGlwYzpbNDAyNjUzMTgzOV1scnd4cnd4 cnd4IDEgcm9vdCByb290IDAgTWFywqAgMiAxNjo0NyBjZ3JvdXAKPiAtPiBjZ3JvdXA6WzQwMjY1 MzE4MzVdIENhbiBzb21lb25lIHBsZWFzZSBzdWdnZXN0IHdpdGggc29tZSB0aG91Z2h0cwo+IG9u IGhvdyB0byBtYWtlIHRoaXMgd29yay4gVGhhbmtzLFJha2VzaCAgIAoKCi0tCkxpbnV4LWF1ZGl0 IG1haWxpbmcgbGlzdApMaW51eC1hdWRpdEByZWRoYXQuY29tCmh0dHBzOi8vd3d3LnJlZGhhdC5j b20vbWFpbG1hbi9saXN0aW5mby9saW51eC1hdWRpdA==