From mboxrd@z Thu Jan 1 00:00:00 1970 From: leam hall Subject: chmod32, lchmod32, etc? Date: Mon, 8 Jul 2013 13:53:24 -0400 Message-ID: Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============2782743109963198656==" Return-path: Received: from mx1.redhat.com (ext-mx12.extmail.prod.ext.phx2.redhat.com [10.5.110.17]) by int-mx11.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id r68HrP4K031308 for ; Mon, 8 Jul 2013 13:53:25 -0400 Received: from mail-pb0-f51.google.com (mail-pb0-f51.google.com [209.85.160.51]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id r68HrOHl015653 for ; Mon, 8 Jul 2013 13:53:24 -0400 Received: by mail-pb0-f51.google.com with SMTP id um15so4534571pbc.38 for ; Mon, 08 Jul 2013 10:53:24 -0700 (PDT) List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com --===============2782743109963198656== Content-Type: multipart/alternative; boundary=047d7bea3daa8efee104e103b890 --047d7bea3daa8efee104e103b890 Content-Type: text/plain; charset=UTF-8 Morning all! My first post to the list. I'm getting errors on a RHEL 5 box when I add audit rules for chown32 and lchown32. Info on the box: Linux myhost 2.6.18-348.6.1.el5 #1 SMP Fri Apr 26 09:21:26 EDT 2013 x86_64 x86_64 x86_64 GNU/Linux Error: service auditd restart Stopping auditd: [ OK ] Starting auditd: [ OK ] Syscall name unknown: chown32 There was an error in line 215 of /etc/audit/audit.rules Line 215: -a exit,always -F arch=b64 -S chown32 What else can I look at to trouble-shoot? Thanks! Leam -- Mind on a Mission --047d7bea3daa8efee104e103b890 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Morning all! My first post t= o the list.

I'm getting errors on a RHEL 5 box when I add audit = rules for chown32 and lchown32.

Info on the box:

Linux myhost 2.6.18-348.6.1.el5 #1 SMP Fri Apr 26 09:21:26 EDT 2013 x86_64 = x86_64 x86_64 GNU/Linux


Error:

service auditd resta= rt
Stopping auditd:=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 [=C2=A0 OK=C2=A0 ]
Starting auditd:=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 [=C2=A0 OK=C2=A0 ]
Syscall= name unknown: chown32
There was an error in line 215 of /etc/audit/audi= t.rules


Line 215:
-a exit,always -F arch=3Db64 -S chown= 32


What else can I look at to trouble-shoot?

Thanks!
<= br>
Leam
--047d7bea3daa8efee104e103b890-- --===============2782743109963198656== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============2782743109963198656==-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: chmod32, lchmod32, etc? Date: Mon, 08 Jul 2013 14:01:13 -0400 Message-ID: <1666664.44RFpIAcff@x2> References: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Monday, July 08, 2013 01:53:24 PM leam hall wrote: > Morning all! My first post to the list. > > I'm getting errors on a RHEL 5 box when I add audit rules for chown32 and > lchown32. > > Info on the box: > > Linux myhost 2.6.18-348.6.1.el5 #1 SMP Fri Apr 26 09:21:26 EDT 2013 x86_64 > x86_64 x86_64 GNU/Linux > > > Error: > > service auditd restart > Stopping auditd: [ OK ] > Starting auditd: [ OK ] > Syscall name unknown: chown32 > There was an error in line 215 of /etc/audit/audit.rules > > > Line 215: > -a exit,always -F arch=b64 -S chown32 > > > What else can I look at to trouble-shoot? The ausyscall program was created just for troubleshooting things like this. # ausyscall x86_64 chown32 Unknown syscall chown32 using x86_64 lookup table # ausyscall i386 chown32 lchown32 198 fchown32 207 chown32 212 So, that means its only a 32bit syscall: -a exit,always -F arch=b32 -S chown32 On 64 bit machines, you normally should have rules for both the 64 bit and 32 bit syscalls. Not all syscalls are on both interfaces. -Steve