[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: [PATCH] audit tools: add filterkey support



I haven't determined how to assign a key to a rule yet (maybe that is part of the problem).

I was able to assign a key using filterkey=MY_RULE_0 and the auid is still off.

data="audit(1151326486.828:62): arch=40000003 syscall=195 success=yes exit=0 a0=9b09080 a1=806a760 a2=8f1ff4 a3=0 items=1 ppid=2329 pid=2696 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 comm="nano" exe="/usr/bin/nano" subj=user_u:system_r:unconfined_t:s0 key="MY_RULE_0""

Steve


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]