Re: Auditd doesn't receive syscalls after installation for the current shell.

Hello there. It seems that the kernel doesn't send messages for syscalls of the shell process from which auditd is installed. Reproducing steps (performed on Ubuntu 22.04 x86_64 on virtual box by `root`): step #1: $ apt install auditd step #2: $ auditctl -a always,exit -F arch=b64 -S openat,renameat2,unlinkat step #3: $ echo t>delme;echo t2>>delme;cat delme;mv delme d;mv d delme;rm delme step #4: $ service auditd stop step #5: $ ausearch -f delme There are syscalls from /usr/bin/cat, /usr/bin/mv, /usr/bin/rm but there are no any syscalls (openat expected) for /usr/bin/bash (current shell process) for the file. If step #3 is performed from another tty, then openat syscalls (CREATE for the first echo and NORMAL for the second one) is logged for the /usr/bin/bash process. `uname -a` returns: Linux grin-vb-ubuntu-22-0-4 5.19.0-41-generic #42~22.04.01-Ubuntu SMP PREEMPT_DYNAMIC Tue Apr 18 17:40:00 UTC 2 x86_64 x86_64 x86_64 GNU/Linux Should I open an issue for the case at https://github.com/linux-audit/audit-kernel ?