Re: auditctl question

[Klaus Weidner <klaus@atsec.com>]

On Thu, Aug 03, 2006 at 04:02:56PM -0400, Williams, P. Lane wrote:
> I installed the 2.6.17.7 kernel and then tried to build audit-1.2.5 and received the following...
> 
> make[2]: Entering directory `/tmp/audit/audit-1.2.5/src'
> gcc -D_REENTRANT -D_GNU_SOURCE -g -O2 -o auditd -pie -Wl,-z -Wl,relro auditd-auditd.o auditd-auditd-event.o auditd-auditd-config.o auditd-auditd-reconfig.o auditd-auditd-sendmail.o auditd-auditd-dispatch.o  -lpthread -L/tmp/audit/audit-1.2.5/src/mt -lauditmt
> gcc -DHAVE_CONFIG_H -I. -I. -I.. -I.. -I../lib   -D_REENTRANT -D_GNU_SOURCE -g -O2 -c auditctl.c
> auditctl.c: In function ‘audit_print_reply’:
> auditctl.c:1046: error: ‘AUDIT_SE_USER’ undeclared (first use in this function)
> auditctl.c:1046: error: (Each undeclared identifier is reported only once
> auditctl.c:1046: error: for each function it appears in.)
> auditctl.c:1047: error: ‘AUDIT_SE_CLR’ undeclared (first use in this function)
> 
> I also received the same error with the other kernel.  I did not build the SE-Linux stuff into the kernel, should I have?

Audit should not require SELinux, but I don't think it currently gets
much testing with SELinux turned off which can cause such build issues.
Steve, do you have a fix for this?

-Klaus