I am using Linux Audit version 2.1.3 and I'm wondering if the following behaviour of auditctl is intentional. When I do a complete list of the current rules (with auditctl -l) I get an exit code of zero, as expected. When I do a list which is restricted to a particular key (auditctl -l -k foo) I get 255. It doesn't matter which of my keys I use and there are no error messages sent to stderr to indicate a problem. The auditctl manpage doesn't say what various exit values mean so I'm not sure what type of error is occurring.
Stephen Quinney -- The University of Edinburgh is a charitable body, registered in Scotland, with registration number SC005336. -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
