[PATCH 1/2] Audit test fix to match rest of checks, also fixed text doc

Andrew Gilmore agilmore2 at gmail.com
Fri Jul 19 20:30:09 UTC 2013


There are 5 tests that already are explicitly always,exit.  I got into
this by fixing the 1 test that was explicitly exit,always.

Do we want to temporarily relax the 5 more restrictive tests to match
the other 34?

Andrew

On Fri, Jul 19, 2013 at 2:03 PM, Steve Grubb <sgrubb at redhat.com> wrote:
> On Friday, July 19, 2013 01:18:14 PM Andrew Gilmore wrote:
>> Great! However, 1/2 of the audit checks have this same syntax, so
>> should I fix all of these tests?
>
> Please standardize on  - action,filter as documented in the auditctl man page.
> While the command will accept either as input, this has caused so much
> confusion that I will probably add a warning at some point soon and then in a
> future release reject the wrong order.
>
> -Steve


More information about the scap-security-guide mailing list