All,
I finally submitted a bug report to the Linux kernel with respect to
invalid audit 'op' values.
The bug is listed as
https://bugzilla.kernel.org/show_bug.cgi?id=73511
and is described as ...
Various audit events dealing with adding, removing and updating
rules result in invalid values set for the op keys which result
in embedded spaces in op= values.
The invalid values are
op="add rule" set in kernel/auditfilter.c
op="remove rule" set in kernel/auditfilter.c
op="remove rule" set in kernel/audit_tree.c
op="updated rules" set in kernel/audit_watch.c
op="remove rule" set in kernel/audit_watch.c
The attached patch replaces the space in the above values with
an underscore character ('_').
A patch was also provided.
One assumes the similar issues (cause keys having values with embedded
spaces) pointed out by Steve in the ima code in
https://www.redhat.com/archives/linux-audit/2014-April/msg00014.html
will also get fixed.
For those interested, I have attached the patch.
Rgds