Re: Double addition of rule yields two log messages
Linda Knippers wrote:
Michael C Thompson wrote:
> Hey all,
>
> Adding a rule successfully (i.e. not malformed and that rule didn't
> already exist) creates a log entry:
> type=CONFIG_CHANGE msg=audit(1147986115.721:28510): auid=0
> subj=root:staff_r:staff_t:s0-s15:c0.c255 add rule to list=2 res=0
>
> Then, adding the same rule again will resulting in an error message
> being reported to the user saying that rule exists (although it uses the
> work "File exists", which if that could be changed to "Rule
exists",
> might be nice). However, despite this apparent failure, we get a log entry:
> type=CONFIG_CHANGE msg=audit(1147986117.389:28511): auid=0
> subj=root:staff_r:staff_t:s0-s15:c0.c255 add rule to list=2 res=0
>
> Most FYI, not sure if this is a problem or not.
That's interesting. When I do this sequence with the .22 kernel
and the 1.2.1 tools:
# auditctl -a entry,always -S all -F pid=1005
# auditctl -a entry,always -S all -F pid=1005
Error sending add rule request (File exists)
I get these records:
type=CONFIG_CHANGE msg=audit(1148054817.056:575): auid=500
subj=user_u:system_r:auditctl_t:s0-s0:c0.c255 add rule to list=2 res=1
type=CONFIG_CHANGE msg=audit(1148054831.417:576): auid=500
subj=user_u:system_r:auditctl_t:s0-s0:c0.c255 add rule to list=2 res=0
I believe res=1 means the operation was successful and the res=0 means
it failed. Are you sure one of your records doesn't have res=1?
Yes, you are infact correct. I missed that with my testing. 1 for the
first entry, 0 for all subsequent doubles.
I don't know what the "add rule to list=2" means
though.
list=2 means that it was added to the entry list, now the CONFIG_CHANGE
messages tell you which filter list it was added to. 2 == entry, 5 ==
exclude, etc.
What is the exact rule you're adding? And which kernel/tools are you
running?
auditctl -a entry,always -S chmod -F se_sen=s0-s15:c
However, the action seems to be independent of the rule. The audit is
1.2.2 and 25 kernel.
Thanks,
Mike