Re: Double addition of rule yields two log messages
Michael C Thompson wrote:
Hey all,
Adding a rule successfully (i.e. not malformed and that rule didn't
already exist) creates a log entry:
type=CONFIG_CHANGE msg=audit(1147986115.721:28510): auid=0
subj=root:staff_r:staff_t:s0-s15:c0.c255 add rule to list=2 res=0
Then, adding the same rule again will resulting in an error message
being reported to the user saying that rule exists (although it uses the
work "File exists", which if that could be changed to "Rule exists",
might be nice). However, despite this apparent failure, we get a log entry:
type=CONFIG_CHANGE msg=audit(1147986117.389:28511): auid=0
subj=root:staff_r:staff_t:s0-s15:c0.c255 add rule to list=2 res=0
Most FYI, not sure if this is a problem or not.
That's interesting. When I do this sequence with the .22 kernel
and the 1.2.1 tools:
# auditctl -a entry,always -S all -F pid=1005
# auditctl -a entry,always -S all -F pid=1005
Error sending add rule request (File exists)
I get these records:
type=CONFIG_CHANGE msg=audit(1148054817.056:575): auid=500
subj=user_u:system_r:auditctl_t:s0-s0:c0.c255 add rule to list=2 res=1
type=CONFIG_CHANGE msg=audit(1148054831.417:576): auid=500
subj=user_u:system_r:auditctl_t:s0-s0:c0.c255 add rule to list=2 res=0
I believe res=1 means the operation was successful and the res=0 means
it failed. Are you sure one of your records doesn't have res=1?
I don't know what the "add rule to list=2" means though.
What is the exact rule you're adding? And which kernel/tools are you
running?
BTW, with RHEL4U2 we only got a record on the success case.
type=CONFIG_CHANGE msg=audit(1148054734.395:10530): auid=500 added an
audit rule
-- ljk