> Here's a patch for version 2.1.3 which solves bug 435682 (
> https://bugzilla.redhat.com/show_bug.cgi?id=435682 ).
> Patched auditctl allows to specify files having spaces in ther names
> - just surround a filename with apostrophes.
This patch also arbitrarily breaks handling of apostrophes and \xFF characters
in filenames; it probably is a marginal improvement, but any change to the
format should IMHO start with an explicit and consistent specification of how
quoting is supposed to work in audit.rules, and then implementing exactly that.
If we do have to change the file format to support spaces, let's do it, but
let's also make sure that we don't need to change it again soon to fix
different artifacts of the parser implementation.
Mirek
--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit
