On Wed, 2009-08-05 at 21:45 -0500, LC Bruzenak wrote: > > I thought that the following would work: > -a never,exit -F subj_type=jcdx_mtdb_t -F obj_type=jcdx_stdb_var_t
Sorry for the false alarm. This one is operator error (at least I think it is; will retest better, so far it appears to work as advertised). I realized I had a rule to audit that event in the list. This one needs the "-A' vice "-a" to ensure it goes to the head of the rule line. LCB. -- LC (Lenny) Bruzenak [email protected] -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
