auditctl question
Steve Grubb
sgrubb at redhat.com
Thu Aug 3 21:06:48 UTC 2006
On Thursday 03 August 2006 16:02, Williams, P. Lane wrote:
> I also received the same error with the other kernel. I did not build the
> SE-Linux stuff into the kernel, should I have?
I think the kernel headers are your problem. I don't think I'd replace that.
And you do not have to have SE Linux enabled since this is a define from the
audit kernel headers. That said, I don't think you need to rebuild the user
space package.
The problem you are seeing would be a kernel bug most likely. It is what
evaluates the rules and decides if it needs to output an event. So, with the
new kernel and auditctl from Suse, do you see the problem?
Thanks,
-Steve
More information about the Linux-audit
mailing list