This reminds me of the "4500 watches" bug.
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=172574
For me, everything worked fine when I had about 40 watches.
Then I loaded about 150 more and I can't list them (I get
the same error you do) but the watches do seem to be working.
I can continue to add them and it doesn't seem to matter where
the files are.
-- ljk
Steve Grubb wrote:
Hi,
I was testing the new watch system and ran across some problems. When I loaded
85 watches + 10 syscall rules, I got this when trying to list them back out:
[EMAIL PROTECTED] watch-perf]# auditctl -l
Error receiving audit netlink packet (No buffer space available)
Error sending rule list request (No buffer space available)
And when I try to add a watch against a file in my home directory, I get this:
[EMAIL PROTECTED] watch-perf]# auditctl -w /root/test/watch-perf/error.txt
Error sending add rule request (Permission denied)
If I move the same file to /etc, it works fine. I ran strace to see where this
is coming from:
sendto(3, "@\4\0\0\363\3\5\0\1\0\0\0\0\0\0\0\4\0\0\0\2\0\0\0\1\0\0"..., 1088,
0, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 1088
poll([{fd=3, events=POLLIN, revents=POLLIN}], 1, 100) = 1
recvfrom(3, "[EMAIL PROTECTED]"...,
8476,
MSG_PEEK|MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) =
36
recvfrom(3, "[EMAIL PROTECTED]"...,
8476,
MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 36
write(2, "Error sending add rule request ("..., 50Error sending add rule
request (Permission denied)) = 50
Looks like the kernel to me. This is using the lspp.16 kernel.
-Steve
--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit
--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit
