amend to #3405, eliminate catch-all

This commit is contained in:
Sergey G. Brester 2022-11-15 14:29:59 +01:00 committed by GitHub
parent 36af3f2502
commit ae5fe2e003
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23

View file

@ -15,7 +15,7 @@ _subj = (?:unconfined_u|system_u):system_r:sshd_t:s0-s0:c0\.c1023
_exe =/usr/sbin/sshd
_terminal = ssh
_anygrp = (?!acct=|exe=|addr=|terminal=|res=)\w+=(?:".*"|\S*)
_anygrp = (?!acct=|exe=|addr=|terminal=|res=)\w+=(?:"[^"]+"|\S*)
_msg = (?:%(_anygrp)s )*acct=(?:"<F-USER>[^"]+</F-USER>"|<F-ALT_USER>\S+</F-ALT_USER>) exe="%(_exe)s" (?:%(_anygrp)s )*addr=<ADDR> terminal=%(_terminal)s res=failed