From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: Difference between "-a exit,always" and "-a always,exit"? Date: Thu, 03 Apr 2014 09:23:34 -0400 Message-ID: <2369373.XVSyS8d0au@x2> References: <6209163.80HeQiKcI1@x2> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Thursday, April 03, 2014 08:36:21 AM leam hall wrote: > You and everyone I know. However, the SCC scan tool is hitting as it > expects "exit,always". Ugh... This would be a SCAP content issue. In doing some research, I found that the problem appears to have been solved in the audit-2.0.6 release. It also seems that a couple rules got accidentally re-introduced in 2.2.3 but was fixed again in 2.3.2. But going back to the content, I just grep'ed through the SSG project and see that they are testing for reversed fields. I'll tell them to fix that. -Steve > On Thu, Apr 3, 2014 at 8:32 AM, Steve Grubb wrote: > > On Thursday, April 03, 2014 08:28:59 AM leam hall wrote: > > > In the audit.rules file, is there a difference between "-a exit,always" > > > and "-a always,exit"? > > > > Nope. Both work fine. I think that for consistency, I have fixed all rules > > files > > to use "-a always,exit". > > > > -Steve