Running auditd from Raspberry Pi (Raspbian)
Kangkook Jee
aixer77 at gmail.com
Mon Oct 26 20:25:57 UTC 2015
Dear Steve,
I built auditctl from recent audit source and tried it again but I failed with the following errors.
pi at raspberrypi ~/audit-2.4.4 $ sudo auditctl -e1 -b 102400
AUDIT_STATUS: enabled=1 flag=1 pid=2022 rate_limit=0 backlog_limit=320 lost=0 backlog=0
(reverse-i-search)`b': sudo auditctl -e1 -^C102400
pi at raspberrypi ~/audit-2.4.4 $ sudo src/auditctl -a exit,always -F arch=armeb -S clone
arch elf mapping not found
pi at raspberrypi ~/audit-2.4.4 $ sudo src/auditctl -a exit,always -S clone
Error detecting machine type
Would you help me with this?
Thanks a lot for your help again!
Regards, Kangkook
> On Oct 26, 2015, at 11:55 AM, Steve Grubb <sgrubb at redhat.com> wrote:
>
> On Friday, October 23, 2015 07:16:40 PM Kangkook Jee wrote:
>> Hi, all
>>
>> From my Raspberry Pi machine (running Debian Wheezy distribution), I could
>> see the kernel is built with audit enabled, and I could manage to install
>> user-space audit client with the following command.
>>
>> pi at raspberrypi ~ $ sudo apt-get install auditd
>>
>> However, when I tried to enable audit issuing the following commands it
>> doesn’t seem to run properly.
>>
>> pi at raspberrypi ~ $ sudo auditctl -l
>> No rules
>> pi at raspberrypi ~ $ sudo auditctl -a entry,always -S open
>> Error detecting machine type
>> pi at raspberrypi ~ $ sudo auditctl -a entry,always -F arch=armeb -S open
>> arch=armeb machine type not found
>>
>> Can anyone tell me whether audit support ARM based linux systems?
>
> Yes. It was added starting in 2.0.4 and was corrected several times.
>
>
>> Here’s my system information and thanks a lot for your help in advance!
>>
>> pi at raspberrypi ~ $ sudo uname -a
>> Linux raspberrypi 3.18.11-v7+ #781 SMP PREEMPT Tue Apr 21 18:07:59 BST 2015
>> armv7l GNU/Linux
>>
>> pi at raspberrypi ~ $ dpkg -l |grep audit
>> ii auditd 1:1.7.18-1.1
>> armhf User space tools for security auditing ii libaudit0
>> 1:1.7.18-1.1 armhf
>
> That one is too old. You need a newer audit package.
>
> -Steve
More information about the Linux-audit
mailing list