From mboxrd@z Thu Jan  1 00:00:00 1970
From: Amy Griffis <amy.griffis@hp.com>
Subject: Re: auditctl -A entry,always -S chmod
Date: Fri, 2 Jun 2006 12:48:05 -0400
Message-ID: <20060602164805.GA7460@zk3.dec.com>
References: <44805AC3.6050908@us.ibm.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Return-path: <linux-audit-bounces@redhat.com>
Content-Disposition: inline
In-Reply-To: <44805AC3.6050908@us.ibm.com>
List-Unsubscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: Michael C Thompson <thompsmc@us.ibm.com>
Cc: Linux Audit <linux-audit@redhat.com>
List-Id: linux-audit@redhat.com

Michael C Thompson wrote:     [Fri Jun 02 2006, 11:35:31AM EDT]
> Hey Amy & Steve,
> 
> I'm not sure if you two are seeing this, but if you insert a rule to the 
> front of the rule list with the -A option, the list it was added to is 
> somewhere lost. Can you confirm that you're seeing this as well? I'm 
> running with audit-1.2.3 and kernel lspp.34

I see the same thing.

> # auditctl -A entry,always -S chmod
> # auditctl -l
> LIST_RULES: (null),always syscall=chmod
> 
> I took a quick look in the user space section of auditctl, but it 
> doesn't seem to be a user space issue. My guess is the 
> AUDIT_FILTER_PREPEND flag is not being treated properly in the kernel 

Yep, looks like it should be cleared after adding the rule.  I'll send
a patch along in a bit.

Thanks,
Amy

> since I believe it does make it's way down intact (it at least gets to 
> audit_send intact).
> 
> Thanks,
> Mike
>