It definitely breaks handling of 0xFF and apostrophe, but in case of 3 year old feature request it's better than nothing :) Obviously, it's better to use something like escape sequences, but the patch was something like a proof-of-concept.
2011/10/21 Miloslav Trmac <[email protected]> > > Here's a patch for version 2.1.3 which solves bug 435682 ( > > https://bugzilla.redhat.com/show_bug.cgi?id=435682 ). > > Patched auditctl allows to specify files having spaces in ther names > > - just surround a filename with apostrophes. > > This patch also arbitrarily breaks handling of apostrophes and \xFF > characters in filenames; it probably is a marginal improvement, but any > change to the format should IMHO start with an explicit and consistent > specification of how quoting is supposed to work in audit.rules, and then > implementing exactly that. > > If we do have to change the file format to support spaces, let's do it, but > let's also make sure that we don't need to change it again soon to fix > different artifacts of the parser implementation. > Mirek >
-- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
