Fun with Auditing

We're seeing some unexpected (to us) behavior with the Informix audit subsystem on IDS 10. Consider the following default mask: $ onaudit -o -y | grep _default_default - ACTB,ALTB,BGTX,CLDB,CMTX,CRIX,DLRW,EXSP,INRW,LKTB,ONCH,ONST,OPDB,RDRW,RLTX,SCSP,STEX,STIL,STLM,STSN,ULTB,UPRW,ALFR,STDS,STPR,STTX,STOM,STRT,STOP,GRFR,RVFR,CRRL,DRRL,GRRL,RVRL,STDP,STRL,STSA,ONMN,RNDB,ONBR,ONPL,CRDM,DRDM,CRRT,DRRT,CRDT,CRCT,DRCT,CRBT,DRTY,CRME,DRME,ALME,CROC,DROC,ALOC,STRS,CRAG,DRAG,STSC Suppose we want to create a mask for user "joeblow" using the default mask as a template. $ onaudit -a -u joeblow -r _default -e -RDRW,INRW,DLRW,UPRW $ onaudit -o -y | grep joeblowjoeblow - ACTB,ALTB,BGTX,CLDB,CMTX,CRIX,EXSP,LKTB,ONCH,ONST,OPDB,RLTX,SCSP,STEX,STIL,STLM,STSN,ULTB,ALFR,STDS,STPR,STTX,STOM,STRT,STOP,GRFR,RVFR,CRRL,DRRL,GRRL,RVRL,STDP,STRL,STSA,ONMN,RNDB,ONBR,ONPL,CRDM,DRDM,CRRT,DRRT,CRDT,CRCT,DRCT,CRBT,DRTY,CRME,DRME,ALME,CROC,DROC,ALOC,STRS,CRAG,DRAG,STSC Everything's happy, the four subtracted masks are gone. But suppose we used a file instead. $ onaudit -d -u joeblow $ cat adtmask.joeblowjoeblow _default -RDRW,INRW,DLRW,UPRW $ onaudit -a -u joeblow -f adtmask.joeblow $ onaudit -o -y | grep joeblowjoeblow - ACTB,ALTB,BGTX,CLDB,CMTX,CRIX,>>DLRW<<,EXSP,>>INRW<<,LKTB,ONCH,ONST,OPDB,>>RDRW<<,RLTX,SCSP,STEX,STIL,STLM,STSN,ULTB,>>UPRW<<,ALFR,STDS,STPR,STTX,STOM,STRT,STOP,GRFR,RVFR,CRRL,DRRL,GRRL,RVRL,STDP,STRL,STSA,ONMN,RNDB,ONBR,ONPL,CRDM,DRDM,CRRT,DRRT,CRDT,CRCT,DRCT,CRBT,DRTY,CRME,DRME,ALME,CROC,DROC,ALOC,STRS,CRAG,DRAG,STSC Whoopsie! Has anyone else seem this? Before anyone asks, yes, we've opened a PMR.

On 2 Apr, 04:58, tgirsch <tgir...@NOSPAM.gmail.com> wrote: > We're seeing some unexpected (to us) behavior with the Informix audit > subsystem on IDS 10. > > Consider the following default mask: > > $ onaudit -o -y | grep _default> _default                                - > ACTB,ALTB,BGTX,CLDB,CMTX,CRIX,DLRW,EXSP,INRW,LKTB,ONCH,ONST,OPDB,RDRW,RLTX,­SCSP,STEX,STIL,STLM,STSN,ULTB,UPRW,ALFR,STDS,STPR,STTX,STOM,STRT,STOP,GRFR,­RVFR,CRRL,DRRL,GRRL,RVRL,STDP,STRL,STSA,ONMN,RNDB,ONBR,ONPL,CRDM,DRDM,CRRT,­DRRT,CRDT,CRCT,DRCT,CRBT,DRTY,CRME,DRME,ALME,CROC,DROC,ALOC,STRS,CRAG,DRAG,­STSC > > Suppose we want to create a mask for user "joeblow" using the default > mask as a template. > > $ onaudit -a -u joeblow -r _default -e -RDRW,INRW,DLRW,UPRW > $ onaudit -o -y | grep joeblow> joeblow                                - > ACTB,ALTB,BGTX,CLDB,CMTX,CRIX,EXSP,LKTB,ONCH,ONST,OPDB,RLTX,SCSP,STEX,STIL,­STLM,STSN,ULTB,ALFR,STDS,STPR,STTX,STOM,STRT,STOP,GRFR,RVFR,CRRL,DRRL,GRRL,­RVRL,STDP,STRL,STSA,ONMN,RNDB,ONBR,ONPL,CRDM,DRDM,CRRT,DRRT,CRDT,CRCT,DRCT,­CRBT,DRTY,CRME,DRME,ALME,CROC,DROC,ALOC,STRS,CRAG,DRAG,STSC > > Everything's happy, the four subtracted masks are gone.  But suppose we > used a file instead. > > $ onaudit -d -u joeblow > $ cat adtmask.joeblow> joeblow        _default        -RDRW,INRW,DLRW,UPRW > $ onaudit -a -u joeblow -f adtmask.joeblow > $ onaudit -o -y | grep joeblow> joeblow                                - > ACTB,ALTB,BGTX,CLDB,CMTX,CRIX,>>DLRW<<,EXSP,>>INRW<<,LKTB,ONCH,ONST,OPDB,>>­RDRW<<,RLTX,SCSP,STEX,STIL,STLM,STSN,ULTB,>>UPRW<<,ALFR,STDS,STPR,STTX,STOM­,STRT,STOP,GRFR,RVFR,CRRL,DRRL,GRRL,RVRL,STDP,STRL,STSA,ONMN,RNDB,ONBR,ONPL­,CRDM,DRDM,CRRT,DRRT,CRDT,CRCT,DRCT,CRBT,DRTY,CRME,DRME,ALME,CROC,DROC,ALOC­,STRS,CRAG,DRAG,STSC > > Whoopsie! > > Has anyone else seem this?  Before anyone asks, yes, we've opened a PMR. I am not an onaudit export but in onaudit -a -u joeblow -f adtmask.joeblow why include the "-u joeblow" part if "joeblow" is a column in the file? This sounds like this does -u joeblow and the -f file seperately.