> I'm not sure that's really necessary, the type=IPC_SET_PERM already tells > you that these are new values. How about simply the following: > > type=IPC_SET_PERM msg=audit(1146863632.117:98): qbytes=0 iuid=501 igid=0 > mode=0
Would you use ouid and ogid in the IPC record? Do we need mode in the IPC record? We have it in the PATH records. -- ljk -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
