Public bug reported: == Impact ==
Ubuntu 22.04.5 LTS (Jammy Jellyfish) After upgrading from kernel 5.15.0-140 to 5.15.0-160 we have multiple issues with auditd rules. Not fixed in 5.15.0-160-generic #170 from proposed repositories. With large auditd.rules augenrules --load allways fail after parsing 135 lines of audit.d rules, no matter what rules we use: root@xxx:~# uname -a Linux xxx 5.15.0-160-generic #170-Ubuntu SMP Wed Oct 1 10:06:56 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux root@xxx:~# /sbin/augenrules --load /sbin/augenrules: No change No rules enabled 1 failure 1 pid 3348 rate_limit 0 backlog_limit 8192 lost 0 backlog 116 backlog_wait_time 60000 backlog_wait_time_actual 0 enabled 1 failure 1 pid 3348 rate_limit 0 backlog_limit 8192 lost 0 backlog 120 backlog_wait_time 60000 backlog_wait_time_actual 0 enabled 1 failure 1 pid 3348 rate_limit 0 backlog_limit 8192 lost 0 backlog 63 backlog_wait_time 60000 backlog_wait_time_actual 0 arch elf mapping not found There was an error in line 135 of /etc/audit/audit.rules == Testcase == Loading many auditd rules (150+, I can provide the .rules file to you for testing) with /sbin/augenrules --load does not work as expected. == Regression Potential == Anything related to netlink sockets: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2126434 ProblemType: Bug DistroRelease: Ubuntu 22.04 Package: linux-image-5.15.0-160-generic 5.15.0-160.170 ProcVersionSignature: Ubuntu 5.15.0-160.170-generic 5.15.189 Uname: Linux 5.15.0-160-generic x86_64 AlsaDevices: total 0 crw-rw---- 1 root audio 116, 1 Oct 8 08:39 seq crw-rw---- 1 root audio 116, 33 Oct 8 08:39 timer AplayDevices: Error: [Errno 2] No such file or directory: 'aplay' ApportVersion: 2.20.11-0ubuntu82.10 Architecture: amd64 ArecordDevices: Error: [Errno 2] No such file or directory: 'arecord' AudioDevicesInUse: Error: command ['fuser', '-v', '/dev/snd/seq', '/dev/snd/timer'] failed with exit code 1: CasperMD5CheckResult: unknown Date: Wed Oct 8 08:41:01 2025 IwConfig: Error: [Errno 2] No such file or directory: 'iwconfig' Lsusb: Error: command ['lsusb'] failed with exit code 1: Lsusb-t: Lsusb-v: Error: command ['lsusb', '-v'] failed with exit code 1: MachineType: VMware, Inc. VMware Virtual Platform PciMultimedia: ProcEnviron: TERM=xterm-256color PATH=(custom, no user) LANG=en_US.UTF-8 SHELL=/bin/bash ProcFB: 0 svgadrmfb ProcKernelCmdLine: BOOT_IMAGE=/vmlinuz-5.15.0-160-generic root=/dev/mapper/ubuntu-root ro ipv6.disable=1 audit=1 audit_backlog_limit=8192 ipv6.disable=1 maybe-ubiquity RelatedPackageVersions: linux-restricted-modules-5.15.0-160-generic N/A linux-backports-modules-5.15.0-160-generic N/A linux-firmware 20220329.git681281e4-0ubuntu3.39 RfKill: Error: [Errno 2] No such file or directory: 'rfkill' SourcePackage: linux UpgradeStatus: Upgraded to jammy on 2023-03-28 (925 days ago) dmi.bios.date: 11/12/2020 dmi.bios.release: 4.6 dmi.bios.vendor: Phoenix Technologies LTD dmi.bios.version: 6.00 dmi.board.name: 440BX Desktop Reference Platform dmi.board.vendor: Intel Corporation dmi.board.version: None dmi.chassis.asset.tag: No Asset Tag dmi.chassis.type: 1 dmi.chassis.vendor: No Enclosure dmi.chassis.version: N/A dmi.ec.firmware.release: 0.0 dmi.modalias: dmi:bvnPhoenixTechnologiesLTD:bvr6.00:bd11/12/2020:br4.6:efr0.0:svnVMware,Inc.:pnVMwareVirtualPlatform:pvrNone:rvnIntelCorporation:rn440BXDesktopReferencePlatform:rvrNone:cvnNoEnclosure:ct1:cvrN/A:sku: dmi.product.name: VMware Virtual Platform dmi.product.version: None dmi.sys.vendor: VMware, Inc. ** Affects: linux (Ubuntu) Importance: Undecided Status: New ** Tags: amd64 apport-bug jammy package-from-proposed uec-images -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2127055 Title: augenrules - unable to load auditd rules (5.15.0-156) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2127055/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
