Linda Knippers wrote:
Michael C Thompson wrote:
Hey all,
Adding a rule successfully (i.e. not malformed and that rule didn't
already exist) creates a log entry:
type=CONFIG_CHANGE msg=audit(1147986115.721:28510): auid=0
subj=root:staff_r:staff_t:s0-s15:c0.c255 add rule to list=2 res=0
Then, adding the same rule again will resulting in an error message
being reported to the user saying that rule exists (although it uses the
work "File exists", which if that could be changed to "Rule exists",
might be nice). However, despite this apparent failure, we get a log entry:
type=CONFIG_CHANGE msg=audit(1147986117.389:28511): auid=0
subj=root:staff_r:staff_t:s0-s15:c0.c255 add rule to list=2 res=0
Most FYI, not sure if this is a problem or not.
That's interesting. When I do this sequence with the .22 kernel
and the 1.2.1 tools:
# auditctl -a entry,always -S all -F pid=1005
# auditctl -a entry,always -S all -F pid=1005
Error sending add rule request (File exists)
I get these records:
type=CONFIG_CHANGE msg=audit(1148054817.056:575): auid=500
subj=user_u:system_r:auditctl_t:s0-s0:c0.c255 add rule to list=2 res=1
type=CONFIG_CHANGE msg=audit(1148054831.417:576): auid=500
subj=user_u:system_r:auditctl_t:s0-s0:c0.c255 add rule to list=2 res=0
I believe res=1 means the operation was successful and the res=0 means
it failed. Are you sure one of your records doesn't have res=1?
Yes, you are infact correct. I missed that with my testing. 1 for the
first entry, 0 for all subsequent doubles.
I don't know what the "add rule to list=2" means though.
list=2 means that it was added to the entry list, now the CONFIG_CHANGE
messages tell you which filter list it was added to. 2 == entry, 5 ==
exclude, etc.
What is the exact rule you're adding? And which kernel/tools are you
running?
auditctl -a entry,always -S chmod -F se_sen=s0-s15:c
However, the action seems to be independent of the rule. The audit is
1.2.2 and 25 kernel.
Thanks,
Mike
--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit
