[PATCH] It IS always,exit NEVER exit,always!

Andrew Gilmore agilmore2 at gmail.com
Mon Jul 22 19:19:47 UTC 2013


I'm still confused though.

When you say "in a future release" are you talking about the
scap-security-guide, or in the audit package?

Andrew

On Mon, Jul 22, 2013 at 1:17 PM, Steve Grubb <sgrubb at redhat.com> wrote:
> On Monday, July 22, 2013 01:02:24 PM Andrew Gilmore wrote:
>> This would make things consistent, but it seemed like Steve stated
>>
>> > While the command will accept either as input, this has caused so much
>> > confusion that I will probably add a warning at some point soon and then
>> > in a future release reject the wrong order."
>>
>> It seems like he expects the current release to accept either for now.
>
> Its been like that since RHEL4 days.
>
>> Do I apply this and make everything more consistent and restrictive, or add
>> "(always,exit|exit,always)" to the 5 tests that are restrictive already?
>>
>> Steve?
>
> If you had grabbed one sentence higher, you would have seen this:
>
> Please standardize on  - action,filter as documented in the auditctl man page.
>
> Meaning, in general will be (always|never,exit|user|task|exclude). But you
> should pick the right permutation for the specific rule test. I have corrected
> all documentation in the yet to be released 2.3.2 audit package.
>
> -Steve


More information about the scap-security-guide mailing list