I was able to find examples of fields like
a5 (see 2) but it doesn't fit the regex which seems to require a pair of square brackets (so that
a4 should be
a4[foo]). I couldn't find any reference in the Linux Audit source code.
My questions are
- Is this regex valid and up-to-date? Or is it an outdated rule which doesn't apply anymore?
- Could you suggest me where to look to see how those arguments to the execve syscall are handled?
- Could you post an example of a record with a field which fits the regex (assuming the regex is valid)?
Note: This question was asked on the Linux Audit mailing list as well but I've not received any feedback yet.