It seems the issue is related to the enabling of auditd immutable mode: auditctl -q /home/ubuntu,/home/ubuntu/testmount
echo $? 0 auditctl -e 2 enabled 2 failure 1 pid 612 rate_limit 0 backlog_limit 32768 lost 0 backlog 4 backlog_wait_time 60000 backlog_wait_time_actual 0 auditctl -q /home/ubuntu,/home/ubuntu/testmount Error sending make_equivalent command (Operation not permitted) I cannot make sense to this behavior change as one of the purpose of adding subtrees to already watched directories is to be able to lock down rules while retaining the ability to dinamically mount (and watch) other filesystems. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2161355 Title: Cannot issue auditctl -q to notify kernel of new subtrees To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2161355/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
