linux-audit.redhat.com archive mirror
 help / color / mirror / Atom feed
* [PATCH] Update auditctl man page for new example on shell escaping.
@ 2021-09-02  6:14 Romesh Upadhyay
  2021-09-11  6:27 ` romesh upadh
  0 siblings, 1 reply; 2+ messages in thread
From: Romesh Upadhyay @ 2021-09-02  6:14 UTC (permalink / raw)
  To: linux-audit; +Cc: Romesh Upadhyay, achillesgaikwad

This commit will add additional example in auditctl(8) manpage which will
help users to use shell escaping while defining the rules through auditctl
command. As some characters require escaping when invoked from a shell.
It is known issue that shell interpret '>' as redirection which results
in auditctl giving errors like "-F missing operation for auid".

Signed-off-by: Romesh Upadhyay <romupadh@gmail.com>
---
 docs/auditctl.8 | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/docs/auditctl.8 b/docs/auditctl.8
index 8069259..e987452 100644
--- a/docs/auditctl.8
+++ b/docs/auditctl.8
@@ -317,6 +317,12 @@ To watch a file for changes (2 ways to express):
 .B auditctl \-a always,exit \-F path=/etc/shadow \-F perm=wa
 .fi
 
+Using shell escaping in bash by defining '\' before '>' to avoid interpretation of special characters such as '>','<' as a file redirection:
+
+.nf
+.B auditctl \-a exit,always \-F arch=b64 \-S fchmodat \-F auid\>=500 \-F auid\!=4294967295 \-k perm_mod
+.fi
+
 To recursively watch a directory for changes (2 ways to express):
 
 .nf
-- 
1.8.3.1

--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit


^ permalink raw reply	[flat|nested] 2+ messages in thread

* Re: [PATCH] Update auditctl man page for new example on shell escaping.
  2021-09-02  6:14 [PATCH] Update auditctl man page for new example on shell escaping Romesh Upadhyay
@ 2021-09-11  6:27 ` romesh upadh
  0 siblings, 0 replies; 2+ messages in thread
From: romesh upadh @ 2021-09-11  6:27 UTC (permalink / raw)
  To: linux-audit

Hello Steve,
Could you please review this patch?

-Romesh

--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit


^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2021-09-13  2:56 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-09-02  6:14 [PATCH] Update auditctl man page for new example on shell escaping Romesh Upadhyay
2021-09-11  6:27 ` romesh upadh

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).