All of lore.kernel.org
 help / color / mirror / Atom feed
* Bad Rule?
@ 2021-07-08 14:26 warron.french
  2021-07-08 15:07 ` Steve Grubb
  0 siblings, 1 reply; 7+ messages in thread
From: warron.french @ 2021-07-08 14:26 UTC (permalink / raw)
  To: Linux Audit


[-- Attachment #1.1: Type: text/plain, Size: 525 bytes --]

I am required to place the following rule into my audit configurations, but
when I do auditd will stop loading rules from this particular rule forward
to the end.

-a always,exit  -F path= /etc/NetworkManager/  -F perm=wa  -F
key=system-locale

The rule immediately above it was:
-a  exit,never -F dir=/usr/local/share/macrovision/storage -k exclude

If I hash out the syntax including NetworkManager all rules load, but
unhashed it stops loading rules from that point to the end.



--------------------------
Warron French

[-- Attachment #1.2: Type: text/html, Size: 911 bytes --]

[-- Attachment #2: Type: text/plain, Size: 106 bytes --]

--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit

^ permalink raw reply	[flat|nested] 7+ messages in thread

end of thread, other threads:[~2021-07-08 19:34 UTC | newest]

Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-07-08 14:26 Bad Rule? warron.french
2021-07-08 15:07 ` Steve Grubb
2021-07-08 17:33   ` warron.french
2021-07-08 18:46     ` Richard Guy Briggs
2021-07-08 19:00       ` warron.french
2021-07-08 19:05       ` Steve Grubb
2021-07-08 19:33         ` warron.french

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.