On Monday, July 08, 2013 01:53:24 PM leam hall wrote: > Morning all! My first post to the list. > > I'm getting errors on a RHEL 5 box when I add audit rules for chown32 and > lchown32. > > Info on the box: > > Linux myhost 2.6.18-348.6.1.el5 #1 SMP Fri Apr 26 09:21:26 EDT 2013 x86_64 > x86_64 x86_64 GNU/Linux > > > Error: > > service auditd restart > Stopping auditd: [ OK ] > Starting auditd: [ OK ] > Syscall name unknown: chown32 > There was an error in line 215 of /etc/audit/audit.rules > > > Line 215: > -a exit,always -F arch=b64 -S chown32 > > > What else can I look at to trouble-shoot?
The ausyscall program was created just for troubleshooting things like this. # ausyscall x86_64 chown32 Unknown syscall chown32 using x86_64 lookup table # ausyscall i386 chown32 lchown32 198 fchown32 207 chown32 212 So, that means its only a 32bit syscall: -a exit,always -F arch=b32 -S chown32 On 64 bit machines, you normally should have rules for both the 64 bit and 32 bit syscalls. Not all syscalls are on both interfaces. -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
