Bug 207666

Summary: [LSPP Audit] auditctl doesn't reject exclude rules with multiple msgtypes
Product: Red Hat Enterprise Linux 5 Reporter: Steve Grubb <sgrubb>
Component: auditAssignee: Steve Grubb <sgrubb>
Status: CLOSED CURRENTRELEASE QA Contact: Brian Brock <bbrock>
Severity: medium Docs Contact:
Priority: medium    
Version: 5.0CC: iboverma, jlaska
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: 5.0.0 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2006-12-19 15:50:59 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Steve Grubb 2006-09-22 13:16:25 UTC 
Description of problem:
This rule:

auditctl -a exclude,always -F msgtype=PATH -F msgtype=CWD

doesn't work as expected. msgtypes are anded by the kernel which means that
instead of suppressing the message, they are output. It should be 1 rule, 1
msgtype to work correctly.

Version-Release number of selected component (if applicable):
1.2.7

How reproducible:
always

Steps to Reproduce:
1. see above rule
Comment 1 Steve Grubb 2006-10-05 17:18:05 UTC 
This was fixed in audit-1.2.8. Thanks for reporting the problem.
Comment 2 James Laska 2006-12-14 13:07:56 UTC 
# rpm -q audit
audit-1.3.1-1.el5

# auditctl -a exclude,always -F msgtype=PATH -F msgtype=CWD
Only one msgtype may be given per rule

Is this the expected result?
Comment 3 Steve Grubb 2006-12-14 13:40:28 UTC 
Yes.
Comment 4 Jay Turner 2006-12-19 15:50:59 UTC 
audit-1.3.1-1.el5 included in 20061218.1 trees.