go-libaudit icon indicating copy to clipboard operation
go-libaudit copied to clipboard

Published 20 hours ago • verified publisher icon elastic

Set result based on AVC specific result

Open andrewkroh opened this issue 7 years ago • 0 comments

Set result field based on seresult and apparmor for AVC messages.

An SELinux AVC event will set seresult=denied.

An AppArmor AVC event will set apparmor=<result> where result can be one of several values.

andrewkroh avatar Apr 27 '18 17:04 andrewkroh