Chapter 6. Tools for Manipulating and Analyzing SELinux

79

interface, source executable, path to the target, and hostname. Criteria matching is all or any. When

you choose a context for a filter, such as under Target Type clicking on Types:, the Select Target

Types window pops up with the available types, as shown in Figure 6 4. These types are just the ones

that are represented in the audit logs:

Figure 6 4. seaudit Editing Filters Select Target Types Window

Instead of picking exact types, you can use wildcard and related matching mechanisms, collectively

called globbing. The techniques are detailed in Table 6 2. All globbing expressions are case sensitive.

Glob Type

Behavior

?

Matches any single character. For example,

a?c

matches

abc

,

aqc

,

a1c

, and so forth.

*

Matches one or more characters. For example,

reg*

matches

regular

,

regex

,

regexp

, and so forth.

[...]

A list of characters searched for in a particular position. For

example,

a[bde]c

matches

abc

,

adc

, and

aec

. The

brackets cannot be empty.

[x y]

This searches for the range of specified characters. The

range is

[ beginning_of_range   end_of_range ]

. You

S

T

S

T

can specify more than one range. For example,

h[a z]ly

matches any word that begins with an

h

and ends with an

ly

and has only one alpha character in between, such as

hrly

,

hmly

, and

hlly

. Another example is

1[2 46 9]0

, which

gives you every combination except

150

. The range is

inclusive, for example,

[a c]

includes

a

,

b

, and

c

, and not

just

b

.