From: Romesh Upadhyay <romupadh@gmail.com>
To: linux-audit@redhat.com
Cc: Romesh Upadhyay <romupadh@gmail.com>, achillesgaikwad@gmail.com
Subject: [PATCH] Update auditctl man page for new example on shell escaping.
Date: Thu, 2 Sep 2021 06:14:44 +0000 [thread overview]
Message-ID: <1630563284-2750-1-git-send-email-romupadh@gmail.com> (raw)
This commit will add additional example in auditctl(8) manpage which will
help users to use shell escaping while defining the rules through auditctl
command. As some characters require escaping when invoked from a shell.
It is known issue that shell interpret '>' as redirection which results
in auditctl giving errors like "-F missing operation for auid".
Signed-off-by: Romesh Upadhyay <romupadh@gmail.com>
---
docs/auditctl.8 | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/docs/auditctl.8 b/docs/auditctl.8
index 8069259..e987452 100644
--- a/docs/auditctl.8
+++ b/docs/auditctl.8
@@ -317,6 +317,12 @@ To watch a file for changes (2 ways to express):
.B auditctl \-a always,exit \-F path=/etc/shadow \-F perm=wa
.fi
+Using shell escaping in bash by defining '\' before '>' to avoid interpretation of special characters such as '>','<' as a file redirection:
+
+.nf
+.B auditctl \-a exit,always \-F arch=b64 \-S fchmodat \-F auid\>=500 \-F auid\!=4294967295 \-k perm_mod
+.fi
+
To recursively watch a directory for changes (2 ways to express):
.nf
--
1.8.3.1
--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit
next reply other threads:[~2021-09-02 12:44 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-09-02 6:14 Romesh Upadhyay [this message]
2021-09-11 6:27 ` [PATCH] Update auditctl man page for new example on shell escaping romesh upadh
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1630563284-2750-1-git-send-email-romupadh@gmail.com \
--to=romupadh@gmail.com \
--cc=achillesgaikwad@gmail.com \
--cc=linux-audit@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.