[prev in list] [next in list] [prev in thread] [next in thread] 

List:       linux-audit
Subject:    Re: exclude's effect with multiple rules
From:       Steve Grubb <sgrubb () redhat ! com>
Date:       2006-08-26 0:50:40
Message-ID: 200608252050.41324.sgrubb () redhat ! com
[Download RAW message or body]

On Friday 25 August 2006 18:04, Michael C Thompson wrote:
> So if I have the following two rules, what should be expected behaviour?
>
> auditctl -a entry,always -S chmod
> auditctl -a exclude,always -S all

The expected behavior is that rule 1 is accepted and rule 2 produces an error 
and is rejected.

-Steve

[prev in list] [next in list] [prev in thread] [next in thread]