Re: Error handling of auditctl -w
On 6/16/20 2:00 PM, Stefan Tauner wrote:
Hi,
I was wondering why my auditctl executions do not print any errors but
apparently didn't do anything. After checking the return value (which
was 255) I looked at the code and noticed that audit_setup_perms() and
audit_update_watch_perms() have virtually no user-visible error reporting.
Are these in a rules file? I was thinking about perhaps a previous "-i"
(i.e. auditctl -i) preceeded your rule, however the man page says it
always returns a success code.
So probably not that, unless the man page doesn't match reality. Can you
provide a little more detail (e.g. parameters)?
Thx,
LCB
--
Lenny Bruzenak
MagitekLTD