[Aide] --after option with aide 0.10 on SuSE

Welf.Tiemann at Bertelsmann.de Welf.Tiemann at Bertelsmann.de
Wed Jun 29 17:19:46 EEST 2005


Hi Richard,
 
it looks to me like aide 0.10 on SuSE ignores (at least parts of) the
--after option.
 
We used to pass the selection definitions rather by this option than in
the cfg file. But it doesn't work with this port any longer.
I.e.
 
	/usr/bin/aide --init -c ./aidetest.conf --after="
	myRule = p+n+u+g+s+b+m+c+md5+sha1
	/usr/bin/aide   myRule
	" -V255

returns
 
	Setting verbosity to 255
	commandconf():@@include ./aidetest.conf
	
	myRule = p+n+u+g+s+b+m+c+md5+sha1
	/usr/bin/aide   myRule
	
	
	@@include
	database =
	database_out =
	Output database set to "file:/var/lib/aide/aide.db.new"
"/var/lib/aide/aide.db.new"
	verbose =
	Verbosity already defined to 255
	report_url =
	WARNING: Debug output enabled
	warn_dead_symlinks =
	Equrule
	Equrule
	Equrule
	Equrule
	Equrule
	Equrule
	Equrule
	db_init 2
	Opening file "/var/lib/aide/aide.db.new" for w+
	db_out is nonnull /var/lib/aide/aide.db.new
	decode base64
	db_init 256
	/ match=0, tree=135473544, attr=0
	...
	r->childs 0, r->parent 0, r->checked 0
	
	AIDE, version 0.10
	
	### AIDE database initialized.
	
where ./aidetest.conf is the sample /etc/aide.conf with all selection
definitions removed.
 
/var/lib/aide/aide.db.new is "empty" then:
 
	RC=0
	@@begin_db
	# This file was generated by Aide, version 0.10
	# Time of generation was 2005-06-29 16:08:36
	@@db_spec name
	@@end_db 

But this still seems to work when used with the --before option.
 
Regards
Welf


More information about the Aide mailing list