From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: operation not supported on filtering Date: Tue, 04 Dec 2018 11:09:34 -0500 Message-ID: <2573614.8dN3b8yfxt@x2> References: <5203097.zTRibRSirQ@x2> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Vincent Fiset Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Tuesday, December 4, 2018 10:15:47 AM EST Vincent Fiset wrote: > > strace /sbin/auditctl -a always,exclude -F msgtype=CWD > log 2>&1 > > Unfortunately I already tried that before, strace was not revealing > anything obvious (for me at least) There's info in there. > sendto(4, > "\34\3\0\0\353\3\5\0\2\0\0\0\0\0\0\0\5\0\0\0\2\0\0\0\1\0\0\0\377\377\377\3 > 77"..., 796, 0, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 796 > poll([{fd=4, events=POLLIN}], 1, 500) = 1 ([{fd=4, revents=POLLIN}]) > recvfrom(4, > "0\3\0\0\2\0\0\0\2\0\0\0\355h\0\0\241\377\377\377\34\3\0\0\353\3\5\0\2\0\0 > \0"..., 8988, MSG_PEEK|MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, > groups=00000000}, [12]) = 816 > recvfrom(4, > "0\3\0\0\2\0\0\0\2\0\0\0\355h\0\0\241\377\377\377\34\3\0\0\353\3\5\0\2\0\0 > \0"..., 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, This ^^^ is the part to interpret: 0\3\0\0\ - length 2\0 - msg type NLMSG_ERROR \0\0 - flags \2\0\0\0 - seq number \355h\0\0\0 - pid \241\377\377\377 - errno EOPNOTSUPP So...your kernel is not supporting this. You'd need to dig through the kernel source to find this. I don't think I can help much past this point as I'm not familiar with the Debian kernels. -Steve