Re: audit rule problem

OK. That's something that can be checked. And I confirm this is the case. [root@x2 ~]# auditctl -a always,exit -F arch=b64 -S open -F subj_type=doesnt_exist_t [root@x2 ~]# echo $? 0 [root@x2 ~]# auditctl -l | grep doesnt_exist_t -a always,exit -F arch=b64 -S open -F subj_type=doesnt_exist_t [root@x2 ~]# auditctl -d always,exit -F arch=b64 -S open -F subj_type=doesnt_exist_t That said, you can also write a rule with auid=40000 which would be an invalid user. The kernel has no concept of what uids are valid. So, I expect we have the same issue with policy. I don't know if the kernel can check if a type is valid. Typically policy is compiled into numbers and that's what the kernel understands. -Steve