From mboxrd@z Thu Jan 1 00:00:00 1970 From: Marcus Meissner Subject: Re: auditd/auditctl SLED10 Date: Fri, 21 Jul 2006 16:35:23 +0200 Message-ID: <20060721143523.GA13632@suse.de> References: <44BF8E4F.3000405@ornl.gov> <44BF9F0D.5010204@hp.com> <1153424647.7866.11.camel@willipl1-ld1.jhuapl.edu> <44BFE2C3.9050405@hp.com> <1153484085.7866.23.camel@willipl1-ld1.jhuapl.edu> <44C0E53A.6020402@hp.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Return-path: Received: from mx3.redhat.com (mx3.redhat.com [172.16.48.32]) by int-mx1.corp.redhat.com (8.12.11.20060308/8.12.11) with ESMTP id k6LEZe0t023747 for ; Fri, 21 Jul 2006 10:35:40 -0400 Received: from mx2.suse.de (mx2.suse.de [195.135.220.15]) by mx3.redhat.com (8.13.1/8.13.1) with ESMTP id k6LEZT50016024 for ; Fri, 21 Jul 2006 10:35:32 -0400 Content-Disposition: inline In-Reply-To: <44C0E53A.6020402@hp.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Linda Knippers Cc: Linux-audit@redhat.com List-Id: linux-audit@redhat.com On Fri, Jul 21, 2006 at 10:31:22AM -0400, Linda Knippers wrote: > Lane Williams wrote: > > Yeah, I had tried that. There is an access syscall. From the looks of > > things the audit version that comes with SuSE has a few problems. I > > know in Red Hat it seems to work as I need it to. SuSE is also using > > Apparmor in place of SELinux, or at least they make it appear that way. > > The audit deamon also does not support file system watches. > > File system watches aren't supported in the upstream kernel until > 2.6.18. > > > Seems the only success=no returns that I receive are when the file does > > not exist. I may also have to add more to my filter in order to get > > what I want. Unfortunately I am stuck with SuSE and will have to > > continue troubleshooting until the patches come out. > > If you're using a 2.6.16 kernel and 1.1.3 audit tools, that seems like > a mismatch. There was a 1.1.4 audit package released back in February > and the release mail mentions apparmor support. > https://www.redhat.com/archives/linux-audit/2006-February/msg00036.html We have integrated AppArmor support in our 1.1.3 packages. (The stuff we sent upstream for 1.1.4). Ciao, Marcus