I just thought to follow up on this problem .... I am still seeing it
using kernel.74 and audit.0.9.14
I noticed that when inserting a watch on a path strlen()=4095 but with a
space in the path, no error is generated and the case passes ...
Brief recap of problem:
inserting watch on path with strlen()=4095 comes back with error from kernel
Starting auditd: [ OK ]
Error sending watch insert request (File name too long)
Error sending watch to kernel
Fail - auditctl command returns 255
FAIL : Path length =PATH_MAX(without null) generated error
- Loulwa