@@ -286,6 +286,8 @@ auditallowx
Audit the access rights defined if there is a valid [`allowx`](cil_access_vector_rules.md#allowx) rule. It does NOT allow access, it only audits the event.
+Note that for this to work there must *also* be valid equivalent [`auditallow`](cil_access_vector_rules.md#auditallow) rules present.
+
**Rule definition:**
(auditallowx source_id target_id|self permissionx_id)
@@ -324,6 +326,7 @@ This example will log an audit event whenever the corresponding [`allowx`](cil_a
(allowx type_1 type_2 (ioctl tcp_socket (range 0x2000 0x20FF)))
+ (auditallow type_1 type_2 (tcp_socket (ioctl))) ;; pre-requisite
(auditallowx type_1 type_2 (ioctl tcp_socket (range 0x2005 0x2010)))
@@ -332,6 +335,8 @@ dontauditx
Do not audit the access rights defined when access denied. This stops excessive log entries for known events.
+Note that for this to work there must *also* be valid equivalent [`dontaudit`](cil_access_vector_rules.md#dontaudit) rules present.
+
Note that these rules can be omitted by the CIL compiler command line parameter `-D` or `--disable-dontaudit` flags.
**Rule definition:**
@@ -370,6 +375,7 @@ Note that these rules can be omitted by the CIL compiler command line parameter
This example will not audit the denied access:
+ (dontaudit type_1 type_2 (tcp_socket (ioctl))) ;; pre-requisite
(dontauditx type_1 type_2 (ioctl tcp_socket (range 0x3000 0x30FF)))
@@ -392,7 +398,7 @@ Note that these rules can be over-ridden by the CIL compiler command line parame
</colgroup>
<tbody>
<tr class="odd">
-<td align="left"><p><code>neverallows</code></p></td>
+<td align="left"><p><code>neverallowx</code></p></td>
<td align="left"><p>The <code>neverallowx</code> keyword.</p></td>
</tr>
<tr class="even">
neverallows should be neverallowx Clearly state that auditallowx and dontauditx only works if there are auditallow and dontaudit equivalent rules respectively. Also fix the examples. Signed-off-by: Dominick Grift <dominick.grift@defensec.nl> --- v2: auditallowx and dontauditx do not work without auditallow and dontaudit equivalents The inconsistent thing is that for example neverallowx does work without neverallow equivalent (same I suspect for allowx) secilc/docs/cil_access_vector_rules.md | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)