auditctl -A entry,always -S chmod
Amy Griffis
amy.griffis at hp.com
Fri Jun 2 16:48:05 UTC 2006
Michael C Thompson wrote: [Fri Jun 02 2006, 11:35:31AM EDT]
> Hey Amy & Steve,
>
> I'm not sure if you two are seeing this, but if you insert a rule to the
> front of the rule list with the -A option, the list it was added to is
> somewhere lost. Can you confirm that you're seeing this as well? I'm
> running with audit-1.2.3 and kernel lspp.34
I see the same thing.
> # auditctl -A entry,always -S chmod
> # auditctl -l
> LIST_RULES: (null),always syscall=chmod
>
> I took a quick look in the user space section of auditctl, but it
> doesn't seem to be a user space issue. My guess is the
> AUDIT_FILTER_PREPEND flag is not being treated properly in the kernel
Yep, looks like it should be cleared after adding the rule. I'll send
a patch along in a bit.
Thanks,
Amy
> since I believe it does make it's way down intact (it at least gets to
> audit_send intact).
>
> Thanks,
> Mike
>
More information about the Linux-audit
mailing list