[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

auditctl task ignores -S flag



Here at IBM we have found that if you create an audit rule which uses "task", then the -S flag has no affect. Rather than only auditing the specified syscalls, all syscalls will generate an audit message. fyi, the -F flag seems to work as expected. If this behavior is acceptable and it doesn't make sense to use the "-S" flag with "task" rules, then auditctl needs to be changed to not accept the -S flag in conjunction with "task", or at least return a warning that the -S flag will be ignored. The man page will also need to be changed in order to state the limitation.

Thanks,
debora


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]