From mboxrd@z Thu Jan  1 00:00:00 1970
From: Michael C Thompson <thompsmc@us.ibm.com>
Subject: Re: auditctl usage for filter lists: "user" , "watch" and "exclude"
Date: Thu, 18 May 2006 10:41:51 -0500
Message-ID: <446C95BF.2020902@us.ibm.com>
References: <446C8915.20606@us.ibm.com> <446C8BCC.1020002@us.ibm.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
Received: from mx3.redhat.com (mx3.redhat.com [172.16.48.32])
	by int-mx1.corp.redhat.com (8.12.11.20060308/8.12.11) with ESMTP id
	k4IFgC6c026223
	for <linux-audit@redhat.com>; Thu, 18 May 2006 11:42:12 -0400
Received: from e35.co.us.ibm.com (e35.co.us.ibm.com [32.97.110.153])
	by mx3.redhat.com (8.13.1/8.13.1) with ESMTP id k4IFg5ow020490
	for <linux-audit@redhat.com>; Thu, 18 May 2006 11:42:05 -0400
Received: from westrelay02.boulder.ibm.com (westrelay02.boulder.ibm.com
	[9.17.195.11])
	by e35.co.us.ibm.com (8.12.11.20060308/8.12.11) with ESMTP id
	k4IFfu1n007319
	for <linux-audit@redhat.com>; Thu, 18 May 2006 11:41:56 -0400
Received: from d03av02.boulder.ibm.com (d03av02.boulder.ibm.com [9.17.195.168])
	by westrelay02.boulder.ibm.com (8.12.10/NCO/VER6.8) with ESMTP id
	k4IFfslD259506
	for <linux-audit@redhat.com>; Thu, 18 May 2006 09:41:56 -0600
Received: from d03av02.boulder.ibm.com (loopback [127.0.0.1])
	by d03av02.boulder.ibm.com (8.12.11/8.13.3) with ESMTP id
	k4IFfs6c003534
	for <linux-audit@redhat.com>; Thu, 18 May 2006 09:41:54 -0600
In-Reply-To: <446C8BCC.1020002@us.ibm.com>
List-Unsubscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: Michael C Thompson <thompsmc@us.ibm.com>
Cc: Linux Audit <linux-audit@redhat.com>
List-Id: linux-audit@redhat.com

Michael C Thompson wrote:
> Michael C Thompson wrote:
>> Hey all,
>>
>> I'm trying to understand better the user, watch and exclude auditctl 
>> filter lists. I believe I have a reasonable understanding of exclude 
>> from some examples Steve gave (see below), but I have very little idea 
>> of how user is meant to be used, and none about watch.
>>
>> Any enlightenment will be helpful.
>>
>> For the exclude list,
>>
>> exclude,always -F msgtype=SYSCALL
>>
>> seems to be the only valid structure, where msgtype can be any value 
>> (XXX) for the type in the audit.log? (where the 1st field in the audit 
>> log is type=XXX)
>>
>> Are there more filters that apply? (and does it have any meaning 
>> without a filter?)
> 
> Question, is it intended for:
> auditctl -a exclude,always -F msgtype=CONFIG_CHANGE
>   and
> auditctl -a exclude,never -F msgtype=CONFIG_CHANGE
> 
> (being active at different times) to both block the CONFIG_CHANGE 
> messages? I would assume that exclude,never to _not_ block messages of 
> that type?

It also seems to be that:

auditctl -a exclude,always -F msgtype=CWD
auditctl -a exclude,always -F msgtype=PATH

and

auditctl -a exclude,always -F msgtype=CWD -F msgtype=PATH

do not work in the same way, in fact, "auditctl -a exclude,always -F 
msgtype=CWD -F msgtype=PATH" does not remove either the CWD or the PATH 
type from the message. Can the exclude list have only 1 msgtype per rule?

Mike