<div dir="ltr"><div>I looked through my old notes and confirmed that I was getting yelled at by someone using a scanner that had hard-coded the entries so I adjusted accordingly.<br><br></div>Thanks!<br><br>Trevor<br></div>
<div class="gmail_extra"><br><br><div class="gmail_quote">On Thu, Jul 11, 2013 at 10:36 AM, Steve Grubb <span dir="ltr"><<a href="mailto:sgrubb@redhat.com" target="_blank">sgrubb@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im">On Wednesday, July 10, 2013 11:39:39 PM Trevor Vaughan wrote:<br>
> "Either order is valid syntax"<br>
><br>
> I could have sworn that this blew up in my face at some point. Perhaps a<br>
> different patch set fixed it.<br>
<br>
</div>Either order is valid syntax for auditctl. Its been this way since RHEL4. Its<br>
not valid if you are running a scanner with a hardcoded ordering.<br>
<span class="HOEnZb"><font color="#888888"><br>
-Steve<br>
</font></span><div class="im HOEnZb"><br>
<br>
> On Sun, Mar 3, 2013 at 9:03 AM, Steve Grubb <<a href="mailto:sgrubb@redhat.com">sgrubb@redhat.com</a>> wrote:<br>
</div><div class="HOEnZb"><div class="h5">> > > > - RHEL5 wants audit rules to start with "exit,always"; RHEL6 wants<br>
> > > > them<br>
> > > > to start with "always,exit". Note that some of the actual RHEL6<br>
> > > > benchmark content checks for both (e.g. adjtimex), while some (the<br>
> > > > majority) does not (e.g. chmod).<br>
> > > ><br>
> > > > -> This was a change in auditd itself. "exit,always" is no longer<br>
> > > > valid.<br>
> ><br>
> > Either order is valid syntax. However, people were asking for order out of<br>
> > chaos and I went through all audit rules and fixed them (in upstream<br>
> > audit) all<br>
> > to have one ordering. This was not because auditctl would reject the rule,<br>
> > its<br>
> > because configuration testers need one order so that rules can be<br>
> > verified.<br>
> ><br>
> > -Steve<br>
> > _______________________________________________<br>
> > scap-security-guide mailing list<br>
> > <a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a><br>
> > <a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
</div></div></blockquote></div><br><br clear="all"><br>-- <br>Trevor Vaughan<br>Vice President, Onyx Point, Inc<br>(410) 541-6699<br><a href="mailto:tvaughan@onyxpoint.com">tvaughan@onyxpoint.com</a><br><br>-- This account not approved for unencrypted proprietary information --
</div>