On Monday 08 December 2008 05:11:45 pm you wrote: > As you can see rule with 'never' action is first introduced but in exit > table they are in reverse order.
Anything with a path or dir in it actually winds up on a hidden filter inside the audit system. It runs from the exit filter, but it is distinct. I am asking Al Viro what his thoughts are about this. This would have been a good email for the mail list so that everyone can see Al's response. -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
