[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

auditctl -A entry,always -S chmod



Hey Amy & Steve,

I'm not sure if you two are seeing this, but if you insert a rule to the front of the rule list with the -A option, the list it was added to is somewhere lost. Can you confirm that you're seeing this as well? I'm running with audit-1.2.3 and kernel lspp.34

# auditctl -A entry,always -S chmod
# auditctl -l
LIST_RULES: (null),always syscall=chmod

I took a quick look in the user space section of auditctl, but it doesn't seem to be a user space issue. My guess is the AUDIT_FILTER_PREPEND flag is not being treated properly in the kernel since I believe it does make it's way down intact (it at least gets to audit_send intact).

Thanks,
Mike


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]