typo

Saeid Hassan-Abadi · Saeid Hassan-Abadi · commit 2ff228f674a3 · 2023-08-24T17:46:48.000+02:00
diff --git a/filter-10-selinux.conf b/filter-10-selinux.conf
@@ -3,7 +3,6 @@ filter {
     add_tag => "selinux"
     tag_on_failure => "selinux_failure"
     overwrite => "[audit_type, audit_epoch, audit_counter]"
-    match => [ "message", "type=%{DATA:selinux_audit_type} msg=audit\(%{NUMBER:selinux_audit_epoch}:%{NUMBER:selinux_audit_counter}\): avc:%{SPACE}%{SPACE}%{DATA:selinux_avc}  \{ %{WORD:selinux_action} \} for  pid=%{NUMBER:selinux_pid} comm=\"%{DATA:selinux_command}\" ((src=%{DATA:selinux_source})?|
-?(name=\"%{DATA:selinux_filename}\" dev=\"%{DATA:selinux_device}\" ino=%{NUMBER:selinux_inode})?) scontext=%{DATA:selinux_source_context} tcontext=%{DATA:selinux_target_context} tclass=%{DATA:selinux_target_class} permissive=%{NUMBER:selinux_permissive}" ]
+    match => [ "message", "type=%{DATA:selinux_audit_type} msg=audit\(%{NUMBER:selinux_audit_epoch}:%{NUMBER:selinux_audit_counter}\): avc:%{SPACE}%{SPACE}%{DATA:selinux_avc}  \{ %{WORD:selinux_action} \} for  pid=%{NUMBER:selinux_pid} comm=\"%{DATA:selinux_command}\" ((src=%{DATA:selinux_source})?|(name=\"%{DATA:selinux_filename}\" dev=\"%{DATA:selinux_device}\" ino=%{NUMBER:selinux_inode})?) scontext=%{DATA:selinux_source_context} tcontext=%{DATA:selinux_target_context} tclass=%{DATA:selinux_target_class} permissive=%{NUMBER:selinux_permissive}" ]
        }
 }

Original file line number	Diff line number	Diff line change
`@@ -3,7 +3,6 @@ filter {`
`3`	`3`	`add_tag => "selinux"`
`4`	`4`	`tag_on_failure => "selinux_failure"`
`5`	`5`	`overwrite => "[audit_type, audit_epoch, audit_counter]"`
`6`		`- match => [ "message", "type=%{DATA:selinux_audit_type} msg=audit\(%{NUMBER:selinux_audit_epoch}:%{NUMBER:selinux_audit_counter}\): avc:%{SPACE}%{SPACE}%{DATA:selinux_avc} \{ %{WORD:selinux_action} \} for pid=%{NUMBER:selinux_pid} comm=\"%{DATA:selinux_command}\" ((src=%{DATA:selinux_source})?\|`
`7`		`-?(name=\"%{DATA:selinux_filename}\" dev=\"%{DATA:selinux_device}\" ino=%{NUMBER:selinux_inode})?) scontext=%{DATA:selinux_source_context} tcontext=%{DATA:selinux_target_context} tclass=%{DATA:selinux_target_class} permissive=%{NUMBER:selinux_permissive}" ]`
	`6`	+ match => [ "message", "type=%{DATA:selinux_audit_type} msg=audit\(%{NUMBER:selinux_audit_epoch}:%{NUMBER:selinux_audit_counter}\): avc:%{SPACE}%{SPACE}%{DATA:selinux_avc} \{ %{WORD:selinux_action} \} for pid=%{NUMBER:selinux_pid} comm=\"%{DATA:selinux_command}\" ((src=%{DATA:selinux_source})?\|(name=\"%{DATA:selinux_filename}\" dev=\"%{DATA:selinux_device}\" ino=%{NUMBER:selinux_inode})?) scontext=%{DATA:selinux_source_context} tcontext=%{DATA:selinux_target_context} tclass=%{DATA:selinux_target_class} permissive=%{NUMBER:selinux_permissive}" ]
`8`	`7`	`}`
`9`	`8`	`}`