I am using Linux Audit version 2.1.3 and I'm wondering if the following behaviour of auditctl is intentional.

When I do a complete list of the current rules (with auditctl -l) I get an exit code of zero, as expected. When I do a list which is restricted to a particular key (auditctl -l -k foo) I get 255. It doesn't matter which of my keys I use and there are no error messages sent to stderr to indicate a problem. The auditctl manpage doesn't say what various exit values mean so I'm not sure what type of error is occurring. Stephen Quinney

On Friday, May 11, 2012 10:34:52 AM Steve Grubb wrote: > On Friday, May 11, 2012 08:20:06 AM Stephen Quinney wrote: > > I am using Linux Audit version 2.1.3 and I'm wondering if the > > following behaviour of auditctl is intentional. > > > > When I do a complete > > list of the current rules (with auditctl -l) I get an exit code of > > zero, as expected. When I do a list which is restricted to a > > particular key (auditctl -l -k foo) I get 255. It doesn't matter which > > of my keys I use and there are no error messages sent to stderr to > > indicate a problem. The auditctl manpage doesn't say what various exit > > values mean so I'm not sure what type of error is occurring. > > No. I think its a bug in the code. This should fix it: https://fedorahosted.org/audit/changeset/694