Re: -w deprecation and -F dir= equivalence
On Thursday, July 23, 2026 3:44:37 AM Eastern Daylight Time
seth(a)soulintheshell.com wrote:
> I'd suggest to try again with a newer version.
I tried to build from the git repository from master, and still observed
the same behavior.
-a always,exit -F dir=/nonexitent -F perm=wa -k nonexistent
ok, so if we trace ^^^ that:
rule goes into the kernel:
sendto(4, [{nlmsg_len=1080, nlmsg_type=AUDIT_ADD_RULE,
nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=2, nlmsg_pid=0},
"\x04\x00\x00\x00\x02\x00\x00\x00\x03\x00\x00\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"...],
1080, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 1080
Answer back:
recvfrom(4, [{nlmsg_len=1100, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0,
nlmsg_seq=2, nlmsg_pid=270500}, {error=-ENOENT, msg=[{nlmsg_len=1080,
nlmsg_type=AUDIT_ADD_RULE, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=2,
nlmsg_pid=0},
"\x04\x00\x00\x00\x02\x00\x00\x00\x03\x00\x00\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"...]}],
8988, MSG_PEEK|MSG_DONTWAIT, {sa_family=AF_NETLINK, nl_pid=0,
nl_groups=00000000}, [12]) = 1100
Message the user:
write(2, "Error sending add rule data requ"..., 63Error sending add rule data
request (No such file or directory)) = 63
The kernel is returning ENOENT. It doesn't matter which form of watch. But
what I tested yesterday is different:
auditctl -a always,exit -F path=/tmp/nonexitent -F perm=wa -k nonexistent
into the kernel:
sendto(4, [{nlmsg_len=1084, nlmsg_type=AUDIT_ADD_RULE,
nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=2, nlmsg_pid=0},
"\x04\x00\x00\x00\x02\x00\x00\x00\x03\x00\x00\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"...],
1084, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 1084
Answer back no error
recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED,
nlmsg_seq=2, nlmsg_pid=271266}, {error=0, msg={nlmsg_len=1084,
nlmsg_type=AUDIT_ADD_RULE, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=2,
nlmsg_pid=0}}], 8988, MSG_PEEK|MSG_DONTWAIT, {sa_family=AF_NETLINK, nl_pid=0,
nl_groups=00000000}, [12]) = 36
It does take paths that do not exist. So, there is a difference in behavior
based on whether it is a path or directory. That might be worth the kernel
folks looking deeper into.
-Steve
The output of `augenrules --load` is:
No rules
enabled 1
failure 1
pid 1591
rate_limit 0
backlog_limit 8192
lost 0
backlog 5
backlog_wait_time 60000
backlog_wait_time_actual 0
enabled 1
failure 1
pid 1591
rate_limit 0
backlog_limit 8192
lost 0
backlog 5
backlog_wait_time 60000
backlog_wait_time_actual 0
enabled 1
failure 1
pid 1591
rate_limit 0
backlog_limit 8192
lost 0
backlog 5
backlog_wait_time 60000
backlog_wait_time_actual 0
Error sending add rule data request (No such file or directory)
There was an error in line 7 of /etc/audit/audit.rules
> How they differ is that '-w' enables all syscalls.
Thanks for the clarification. I was using `-F path|dir` with `-S all`,
which I understand now, was defaiting the purpose of the change.
-Seth