From: Michael C Thompson <thompsmc@us.ibm.com>
To: Steve Grubb <sgrubb@redhat.com>
Cc: Linux Audit <linux-audit@redhat.com>
Subject: Re: audit 1.2.2 released
Date: Wed, 17 May 2006 16:43:10 -0500 [thread overview]
Message-ID: <446B98EE.2050903@us.ibm.com> (raw)
In-Reply-To: <200605171723.25311.sgrubb@redhat.com>
Steve Grubb wrote:
> On Wednesday 17 May 2006 17:12, Michael C Thompson wrote:
>>> Please let me know if there are any problems with this release.
>> auditctl -a entry,always -S chmod -F "watch=/root/file"
>>
>> This fails... how is one supposed to use the new 'watch' field filter?
>
> This was already reported on SE Linux mail list last week. The short answer is
> that policy needs to be adjusted to make this work. I don't know if the
> changes have been rolled out yet. Just as a test, try "setenforce 0" and then
> load the audit rule.
The above command was tried in permissive mode. The resulting error is:
# auditctl -a entry,always -S chmod -F "watch=/root/file"
-F unknown field: watch=/root/file
Thanks,
Mike
next prev parent reply other threads:[~2006-05-17 21:43 UTC|newest]
Thread overview: 43+ messages / expand[flat|nested] mbox.gz Atom feed top
2006-05-12 21:26 audit 1.2.2 released Steve Grubb
2006-05-15 19:57 ` Michael C Thompson
2006-05-15 20:04 ` Steve Grubb
2006-05-15 20:14 ` Michael C Thompson
2006-05-16 14:53 ` Michael C Thompson
2006-05-16 15:23 ` Steve Grubb
2006-05-16 16:08 ` Michael C Thompson
2006-05-16 16:28 ` Steve Grubb
2006-05-16 15:34 ` Steve Grubb
2006-05-16 15:53 ` Linda Knippers
2006-05-16 17:23 ` Steve Grubb
2006-05-16 20:38 ` Michael C Thompson
2006-05-16 21:49 ` Steve Grubb
2006-05-16 22:31 ` Valdis.Kletnieks
2006-05-17 10:25 ` Steve Grubb
2006-05-22 17:31 ` Steve Grubb
2006-05-22 19:15 ` Xin Zhao
2006-05-22 19:24 ` Steve Grubb
2006-05-22 19:37 ` Xin Zhao
2006-05-22 19:47 ` Steve Grubb
2006-05-22 20:15 ` Xin Zhao
2006-05-23 6:56 ` Amy Griffis
2006-05-23 3:43 ` Xin Zhao
2006-05-23 15:11 ` Steve Grubb
2006-05-23 16:24 ` Michael C Thompson
2006-05-23 22:20 ` Michael C Thompson
2006-05-23 23:05 ` Linda Knippers
2006-05-24 19:44 ` Michael C Thompson
2006-05-24 20:58 ` James Antill
2006-05-25 13:48 ` Michael C Thompson
2006-05-25 15:16 ` James Antill
2006-05-25 15:22 ` Michael C Thompson
2006-05-25 15:40 ` James Antill
2006-05-24 13:04 ` Steve Grubb
2006-05-24 20:30 ` Michael C Thompson
2006-05-17 15:32 ` Michael C Thompson
2006-05-17 15:45 ` Michael C Thompson
2006-05-17 21:12 ` Michael C Thompson
2006-05-17 21:23 ` Steve Grubb
2006-05-17 21:43 ` Michael C Thompson [this message]
2006-05-17 21:55 ` Steve Grubb
-- strict thread matches above, loose matches on Subject: below --
2006-05-25 15:50 Chad Hanson
2006-05-26 16:05 ` Darrel Goeddel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=446B98EE.2050903@us.ibm.com \
--to=thompsmc@us.ibm.com \
--cc=linux-audit@redhat.com \
--cc=sgrubb@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox