Michael C Thompson wrote: [Fri Jun 02 2006, 11:35:31AM EDT] > Hey Amy & Steve, > > I'm not sure if you two are seeing this, but if you insert a rule to the > front of the rule list with the -A option, the list it was added to is > somewhere lost. Can you confirm that you're seeing this as well? I'm > running with audit-1.2.3 and kernel lspp.34
I see the same thing. > # auditctl -A entry,always -S chmod > # auditctl -l > LIST_RULES: (null),always syscall=chmod > > I took a quick look in the user space section of auditctl, but it > doesn't seem to be a user space issue. My guess is the > AUDIT_FILTER_PREPEND flag is not being treated properly in the kernel Yep, looks like it should be cleared after adding the rule. I'll send a patch along in a bit. Thanks, Amy > since I believe it does make it's way down intact (it at least gets to > audit_send intact). > > Thanks, > Mike > -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
