From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Walt Powell" Subject: Syscall issues with Audit 1.0.14 and linux 2.6.9-42.0.10 Date: Tue, 20 Mar 2007 16:52:46 -0400 Message-ID: <000001c76b32$6b64e660$6400a8c0@powerbox> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============1573424427==" Return-path: Received: from mx1.redhat.com (mx1.redhat.com [172.16.48.31]) by int-mx1.corp.redhat.com (8.13.1/8.13.1) with ESMTP id l2KKvppi026435 for ; Tue, 20 Mar 2007 16:57:51 -0400 Received: from ms-smtp-02.ohiordc.rr.com (ms-smtp-02.ohiordc.rr.com [65.24.5.136]) by mx1.redhat.com (8.13.1/8.13.1) with ESMTP id l2KKvhgo018911 for ; Tue, 20 Mar 2007 16:57:43 -0400 Received: from powerbox (cpe-65-189-170-115.columbus.res.rr.com [65.189.170.115]) by ms-smtp-02.ohiordc.rr.com (8.13.6/8.13.6) with SMTP id l2KKvg5I012511 for ; Tue, 20 Mar 2007 16:57:42 -0400 (EDT) List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com This is a multi-part message in MIME format. --===============1573424427== Content-Type: multipart/alternative; boundary="----=_NextPart_000_0009_01C76B10.2FB9E830" This is a multi-part message in MIME format. ------=_NextPart_000_0009_01C76B10.2FB9E830 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable All: When using linux kernel-smp-2.6.9-42.0.10.EL and audit-1.0.14-1.EL In the audit.rules files -a entry, always -S chmod errors out. Does not recognize 'chmod'. It works in kernel-smp-2.6.9-42.EL given the same audit rpm Is the syscalls list for 2.6.9-42.0.10.EL radically different, and if = so, is there a list of the syscalls available for audit somewhere? ------=_NextPart_000_0009_01C76B10.2FB9E830 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
All:
 
When using linux = kernel-smp-2.6.9-42.0.10.EL and=20 audit-1.0.14-1.EL
 
In the audit.rules files
 
-a entry, always -S chmod
 
errors out.  Does not recognize=20 'chmod'.
 
It works in kernel-smp-2.6.9-42.EL = given the same=20 audit rpm
 
Is the syscalls list for = 2.6.9-42.0.10.EL radically=20 different, and if so, is there a list of the syscalls available for = audit=20 somewhere?
 
 
------=_NextPart_000_0009_01C76B10.2FB9E830-- --===============1573424427== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============1573424427==--