Unable to filter on negative values

[Michael C Thompson]

k1rkland at us.ltcfwd.linux.ibm.com wrote on 02/14/2006 01:14:46 PM:

> On Tue, 2006-02-14 at 13:17 -0500, Linda Knippers wrote:
> > It seems to work with a rule like this:
> > /sbin/auditctl -a exit,always -S pread64 -F success=no -F exit=9
> 
> Should we in userspace then translate something like
> /sbin/auditctl -a exit,always -S pread64 -F exit=-9
> to
> /sbin/auditctl -a exit,always -S pread64 -F success=no -F exit=9

I would say yes, seeing as that is an audit-ism that people shouldn't be 
forced to deal with. (And it should be a simple patch to get that to 
work).


Mike
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20060214/884bfd80/attachment.htm>