Hi,
On Wednesday 30 July 2008 21:38:26 chuli wrote:
> When I use "-a user,always -S open", errors will be reported. But when I
> use "-S open -a user,always", no errors will report. There is no
> corresponding codes to deal with the later format.
I'm still thinking about this patch. I'll look a
fprintf(stderr,
+ "Error: syscall auditing cannot be put on
exclude list\n");
+ return -1;
+ }
+ }
if (add != AUDIT_FILTER_UNSET) {
// if !task add s
(AUDIT_FILTER_MASK|AUDIT_FILTER_UNSET)) ==
AUDIT_FILTER_TASK)) {
@@ -1206,10 +1200,6 @@ int main(int argc, char *argv[])
static int handle_request(int status)
{
if (status == 0) {
- if (audit_syscalladded) {
- fprintf(stder
On Wednesday 06 August 2008 03:27:00 Chu Li wrote:
> And I found another problem, when using "-a 'list','action' -w /mnt", it
> will always add the rule "LIST_RULES: exit,always dir=/mnt (0x4) perm=rwxa".
> I found "-w" will use the "exit" list automatically. I think it's better to
> add something
