From: "Dustin Kirkland" <dustin.kirkland@gmail.com>
To: Linux Audit Discussion <linux-audit@redhat.com>
Subject: Re: Many rules one one line
Date: Mon, 3 Apr 2006 22:08:50 -0500 [thread overview]
Message-ID: <d9c105ea0604032008s21f7df6cq7a17cdb2d3237e53@mail.gmail.com> (raw)
In-Reply-To: <d9c105ea0604032008gf9e908g12ae45119f2376bf@mail.gmail.com>
On 4/3/06, Mont Rothstein <mont.rothstein@gmail.com> wrote:
> Is there any reason not to put many rules on one line in audit.rules?
>
> Ex:
> -a exit, always -S creat -S open -S truncate -S truncate64 -S ftruncate -S
> ftruncate64 -S unlink -S link -S symlink -S rename -S mkdir -S rmdir -F
> devmajor=253 -F devminor=1
Yes, that is preferred. The total overhead of storing this rule in
the kernel is reduced, and it's more efficient for the kernel
filtering code to iterate over.
You might have missed it, but this is exactly what Steve Grubb
recommended to you on 3/28:
https://www.redhat.com/archives/linux-audit/2006-March/msg00249.html
:-Dustin
prev parent reply other threads:[~2006-04-04 3:08 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2006-04-03 22:43 Many rules one one line Mont Rothstein
[not found] ` <d9c105ea0604032008gf9e908g12ae45119f2376bf@mail.gmail.com>
2006-04-04 3:08 ` Dustin Kirkland [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=d9c105ea0604032008s21f7df6cq7a17cdb2d3237e53@mail.gmail.com \
--to=dustin.kirkland@gmail.com \
--cc=linux-audit@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox