[PATCH 1/2] Audit test fix to match rest of checks, also fixed text doc
Andrew Gilmore
agilmore2 at gmail.com
Fri Jul 19 20:30:09 UTC 2013
There are 5 tests that already are explicitly always,exit. I got into
this by fixing the 1 test that was explicitly exit,always.
Do we want to temporarily relax the 5 more restrictive tests to match
the other 34?
Andrew
On Fri, Jul 19, 2013 at 2:03 PM, Steve Grubb <sgrubb at redhat.com> wrote:
> On Friday, July 19, 2013 01:18:14 PM Andrew Gilmore wrote:
>> Great! However, 1/2 of the audit checks have this same syntax, so
>> should I fix all of these tests?
>
> Please standardize on - action,filter as documented in the auditctl man page.
> While the command will accept either as input, this has caused so much
> confusion that I will probably add a warning at some point soon and then in a
> future release reject the wrong order.
>
> -Steve
More information about the scap-security-guide
mailing list