key options with spaces
I was playing with audit rules using keys with spaces.
Is the following expected (ignore the logic; was just testing the returns)?
# auditctl -l -k lsmod LIST_RULES: exit,always watch=/sbin/lsmod perm=x key=lsmod kernel LIST_RULES: exit,always watch=/bin/ping perm=x key=lsmod ping
Thx,
LCB
Signature · 2 lines
LC (Lenny) Bruzenak [email protected]
Quoted 11 lines · LC Bruzenak
I was playing with audit rules using keys with spaces.
Is the following expected (ignore the logic; was just testing the returns)?# auditctl -l -k lsmod LIST_RULES: exit,always watch=/sbin/lsmod perm=x key=lsmod kernel LIST_RULES: exit,always watch=/bin/ping perm=x key=lsmod pingThx,
LCB
Sorry - forgot the version : audit-2.2-1.
Thx,
LCB
Signature · 2 lines
LC (Lenny) Bruzenak [email protected]
Quoted 6 lines · LC Bruzenak
I was playing with audit rules using keys with spaces.
Is the following expected (ignore the logic; was just testing the returns)?# auditctl -l -k lsmod LIST_RULES: exit,always watch=/sbin/lsmod perm=x key=lsmod kernel LIST_RULES: exit,always watch=/bin/ping perm=x key=lsmod ping
What are you expecting? I can make it not accept keys with spaces. I don't think putting spaces in keys is a good idea.
-Steve
Hey Steve,
I was expecting it to not match the one with the spaces.
I can live with any answer; either disallowing spaces or allowing spaces and matching exactly, or (less desirable) even if it is desired to match the first occurrence of the string and it is noted as such in the man page.
The reason I tried the spaces was at direction from a security guy who was looking at a (now-mofied) RHEL 6 STIG beta release. I am not a fan of the spaces myself; was probably going to substitute underscores.
Thanks,
LCB
Quoted 14 lines · Steve Grubb
Quoted 2 lines · LC Bruzenak
I was playing with audit rules using keys with spaces. Is the following expected (ignore the logic; was just testing the
returns)?
Quoted 4 lines
# auditctl -l -k lsmod LIST_RULES: exit,always watch=/sbin/lsmod perm=x key=lsmod kernel LIST_RULES: exit,always watch=/bin/ping perm=x key=lsmod pingWhat are you expecting? I can make it not accept keys with spaces. I don't think putting spaces in keys is a good idea.
-Steve
Signature · 2 lines
LC (Lenny) Bruzenak [email protected]