It seems the issue is related to the enabling of auditd immutable mode:

auditctl -q /home/ubuntu,/home/ubuntu/testmount

echo $?
0

auditctl -e 2
enabled 2
failure 1
pid 612
rate_limit 0
backlog_limit 32768
lost 0
backlog 4
backlog_wait_time 60000
backlog_wait_time_actual 0

auditctl -q /home/ubuntu,/home/ubuntu/testmount
Error sending make_equivalent command (Operation not permitted)

I cannot make sense to this behavior change as one of the purpose of
adding subtrees to already watched directories is to be able to lock
down rules while retaining the ability to dinamically mount (and watch)
other filesystems.

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2161355

Title:
  Cannot issue auditctl -q to notify kernel of new subtrees

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2161355/+subscriptions


-- 
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

Reply via email to