Hi, Below is the complete log of the session where I did : 1) remove all rules 2) change root's shell using chsh 3) ausearch 4) change root's shell using usermod 4 ausearch There is no event at all for the chsh Philippe [root@xxxxxxxxx ~]# auditctl -D No rules [root@xxxxxxxxx ~]# getent passwd root root:x:0:0:root@xxxxxxxxx:/root:/bin/bash [root@xxxxxxxxx ~]# chsh -l /bin/sh /bin/bash /usr/bin/sh /usr/bin/bash /usr/bin/tlog-rec-session [root@xxxxxxxxx ~]# chsh -s /usr/bin/tlog-rec-session root Changing shell for root. Shell changed. [root@xxxxxxxxx ~]# ausearch -ts recent -i node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.516:9514) : auid=u12345 ses=104 op=remove_rule key=(null) list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.516:9515) : auid=u12345 ses=104 op=remove_rule key=(null) list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.516:9516) : auid=u12345 ses=104 op=remove_rule key=(null) list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9517) : auid=u12345 ses=104 op=remove_rule key=(null) list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9518) : auid=u12345 ses=104 op=remove_rule key=(null) list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9519) : auid=u12345 ses=104 op=remove_rule key=32bit-abi list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9520) : auid=u12345 ses=104 op=remove_rule key=ignore_chrony list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9521) : auid=u12345 ses=104 op=remove_rule key=10.2.1-cardholder-access list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9522) : auid=u12345 ses=104 op=remove_rule key=10.2.3-access-audit-trail list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9523) : auid=u12345 ses=104 op=remove_rule key=10.2.3-access-audit-trail list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9524) : auid=u12345 ses=104 op=remove_rule key=10.2.3-access-audit-trail list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9525) : auid=u12345 ses=104 op=remove_rule key=10.2.3-access-audit-trail list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9526) : auid=u12345 ses=104 op=remove_rule key=10.2.3-access-audit-trail list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9527) : auid=u12345 ses=104 op=remove_rule key=10.2.3-access-audit-trail list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9528) : auid=u12345 ses=104 op=remove_rule key=10.2.5.b-elevated-privs-session list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9529) : auid=u12345 ses=104 op=remove_rule key=10.2.5.b-elevated-privs-session list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9530) : auid=u12345 ses=104 op=remove_rule key=10.2.5.b-elevated-privs-setuid list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9531) : auid=u12345 ses=104 op=remove_rule key=10.2.5.b-elevated-privs-cmd list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9532) : auid=u12345 ses=104 op=remove_rule key=10.2.5.c-accounts list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9533) : auid=u12345 ses=104 op=remove_rule key=10.2.5.c-accounts list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9534) : auid=u12345 ses=104 op=remove_rule key=10.2.5.c-accounts list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9535) : auid=u12345 ses=104 op=remove_rule key=10.2.5.c-accounts list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9536) : auid=u12345 ses=104 op=remove_rule key=10.2.5.c-accounts list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9537) : auid=u12345 ses=104 op=remove_rule key=10.4.2b-time-change list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9538) : auid=u12345 ses=104 op=remove_rule key=10.4.2b-time-change list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9539) : auid=u12345 ses=104 op=remove_rule key=10.4.2b-time-change list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9540) : auid=u12345 ses=104 op=remove_rule key=10.5.5-modification-audit list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9541) : auid=u12345 ses=104 op=remove_rule key=10.2.7-module-load list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9542) : auid=u12345 ses=104 op=remove_rule key=10.2.7-module-load list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9543) : auid=u12345 ses=104 op=remove_rule key=10.2.7-module-unload list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9544) : auid=u12345 ses=104 op=remove_rule key=10.2.7-module-unload list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9545) : auid=u12345 ses=104 op=remove_rule key=external-access list=exit res=yes [root@xxxxxxxxx ~]# usermod -s /bin/bash root [root@xxxxxxxxx ~]# ausearch -ts recent -i ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.516:9514) : auid=u12345 ses=104 op=remove_rule key=(null) list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.516:9515) : auid=u12345 ses=104 op=remove_rule key=(null) list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.516:9516) : auid=u12345 ses=104 op=remove_rule key=(null) list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9517) : auid=u12345 ses=104 op=remove_rule key=(null) list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9518) : auid=u12345 ses=104 op=remove_rule key=(null) list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9519) : auid=u12345 ses=104 op=remove_rule key=32bit-abi list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9520) : auid=u12345 ses=104 op=remove_rule key=ignore_chrony list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9521) : auid=u12345 ses=104 op=remove_rule key=10.2.1-cardholder-access list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9522) : auid=u12345 ses=104 op=remove_rule key=10.2.3-access-audit-trail list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9523) : auid=u12345 ses=104 op=remove_rule key=10.2.3-access-audit-trail list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9524) : auid=u12345 ses=104 op=remove_rule key=10.2.3-access-audit-trail list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9525) : auid=u12345 ses=104 op=remove_rule key=10.2.3-access-audit-trail list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9526) : auid=u12345 ses=104 op=remove_rule key=10.2.3-access-audit-trail list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9527) : auid=u12345 ses=104 op=remove_rule key=10.2.3-access-audit-trail list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9528) : auid=u12345 ses=104 op=remove_rule key=10.2.5.b-elevated-privs-session list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9529) : auid=u12345 ses=104 op=remove_rule key=10.2.5.b-elevated-privs-session list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9530) : auid=u12345 ses=104 op=remove_rule key=10.2.5.b-elevated-privs-setuid list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9531) : auid=u12345 ses=104 op=remove_rule key=10.2.5.b-elevated-privs-cmd list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9532) : auid=u12345 ses=104 op=remove_rule key=10.2.5.c-accounts list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9533) : auid=u12345 ses=104 op=remove_rule key=10.2.5.c-accounts list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9534) : auid=u12345 ses=104 op=remove_rule key=10.2.5.c-accounts list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9535) : auid=u12345 ses=104 op=remove_rule key=10.2.5.c-accounts list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9536) : auid=u12345 ses=104 op=remove_rule key=10.2.5.c-accounts list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9537) : auid=u12345 ses=104 op=remove_rule key=10.4.2b-time-change list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9538) : auid=u12345 ses=104 op=remove_rule key=10.4.2b-time-change list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9539) : auid=u12345 ses=104 op=remove_rule key=10.4.2b-time-change list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9540) : auid=u12345 ses=104 op=remove_rule key=10.5.5-modification-audit list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9541) : auid=u12345 ses=104 op=remove_rule key=10.2.7-module-load list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9542) : auid=u12345 ses=104 op=remove_rule key=10.2.7-module-load list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9543) : auid=u12345 ses=104 op=remove_rule key=10.2.7-module-unload list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9544) : auid=u12345 ses=104 op=remove_rule key=10.2.7-module-unload list=exit res=yes ---- node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9545) : auid=u12345 ses=104 op=remove_rule key=external-access list=exit res=yes ---- node=xxxxxxxxx type=USER_MGMT msg=audit(01/06/2020 10:04:22.552:9546) : pid=6937 uid=root auid=u12345 ses=104 msg='op=changing-shell id=root exe=/usr/sbin/usermod hostname=xxxxxxxxx addr=? terminal=pts/0 res=success' -----Message d'origine----- De : Steve Grubb [mailto:sgrubb@redhat.com] Envoyé : samedi 4 janvier 2020 22:12 À : linux-audit(a)redhat.com Cc : MAUPERTUIS, PHILIPPE Objet : Re: USER_MGMT event On Monday, December 30, 2019 12:29:13 PM EST MAUPERTUIS, PHILIPPE wrote: It depends. Did you get any event at all? There is a chance that you just have mismatching events. There should be an event for both. Let's see what the answer is for the above. But potentially yes. And if there is any change we'll be sure to get this into upstream shadow-utils so its uniform across all distros. -Steve equensWorldline is a registered trade mark and trading name owned by the Worldline Group through its holding company. This e-mail and the documents attached are confidential and intended solely for the addressee. If you receive this e-mail in error, you are not authorized to copy, disclose, use or retain it. Please notify the sender immediately and delete this email from your systems. As emails may be intercepted, amended or lost, they are not secure. EquensWorldline and the Worldline Group therefore can accept no liability for any errors or their content. Although equensWorldline and the Worldline Group endeavours to maintain a virus-free network, we do not warrant that this transmission is virus-free and can accept no liability for any damages resulting from any virus transmitted. The risks are deemed to be accepted by everyone who communicates with equensWorldline and the Worldline Group by email