This repository was archived by the owner on Sep 18, 2020. It is now read-only.
Open
Conversation
dm0-
reviewed
May 18, 2018
| # For info on configuring audit rules see the auditctl man page and | ||
| # https://github.com/torvalds/linux/blob/master/include/uapi/linux/audit.h | ||
|
|
||
| -a exclude,always -F msgtype<1400 -F msgtype>1499 -F msgtype!=CONFIG_CHANGE |
Contributor
There was a problem hiding this comment.
Doesn't this mean msgtype<1400 && msgtype>1499 which will never match?
Contributor
Author
There was a problem hiding this comment.
@dm0- Well, yes and no...
It seems the > and < operators don't work with the msgtype field, so auditctl will add the rule successfully, but it doesn't seem to have any effect. I was seeing the AVC messages in my tests so thought things were OK. I'll push out an updated patch.
glevand
force-pushed
the
for-merge-audit
branch
2 times, most recently
from
5454fd6 to
73825f0
Compare
The existing rules were not giving the correct message filter. Fix that and add some comments for users wishing to modify the default rules. Signed-off-by: Geoff Levand <geoff@infradead.org>
The --with-arm and --with-aarch64 configure script options need to be
set when building for the arm64-usr target.
Fixes runtime errors like these when adding machine/arch specific rules:
# auditctl -a exit,always -S fchmod
Error detecting machine type
# auditctl -a exit,always -F arch=aarch64 -S fchmod
arch elf mapping not found
Signed-off-by: Geoff Levand <geoff@infradead.org>
Contributor
Author
|
Rebased to latest. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the audit rules for both boards and fixes run-time errors on arm64.