[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Why doesn't this rule block syscall records?



I was trying out a syscall entry rule that I thought would block audit records from system services/daemons that haven’t had their audit ID (auid) set yet.  I’ve tried both:

 

-a entry,never -S all -F auid=-1

AND

-a entry,never -S all -F auid=4294967295

 

(4294967295) is the value that shows up in the audit log for these services.  I would have thought this rule was saying that at syscall entry (for any system call), don’t generate an audit event if the auid is -1 or 4294967295.  It seems to have the opposite effect.  Have I missed something?  Is this rule not saying what I want?

 

--Tad Taylor


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]