Watch problems

Watch problems

[Steve Grubb]

Hi,

I was testing the new watch system and ran across some problems. When I loaded 
85 watches + 10 syscall rules, I got this when trying to list them back out:

[root@localhost watch-perf]# auditctl -l
Error receiving audit netlink packet (No buffer space available)
Error sending rule list request (No buffer space available)

And when I try to add a watch against a file in my home directory, I get this:

[root@localhost watch-perf]# auditctl -w /root/test/watch-perf/error.txt
Error sending add rule request (Permission denied)

If I move the same file to /etc, it works fine. I ran strace to see where this 
is coming from:

sendto(3, "@\4\0\0\363\3\5\0\1\0\0\0\0\0\0\0\4\0\0\0\2\0\0\0\1\0\0"..., 1088,
0, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 1088
poll([{fd=3, events=POLLIN, revents=POLLIN}], 1, 100) = 1
recvfrom(3, "$\0\0\0\2\0\0\0\1\0\0\0\261\10\0\0\363\377\377\377@\4\0"...,
8476,
MSG_PEEK|MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) =
36
recvfrom(3, "$\0\0\0\2\0\0\0\1\0\0\0\261\10\0\0\363\377\377\377@\4\0"...,
8476,
MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 36
write(2, "Error sending add rule request ("..., 50Error sending add rule
request (Permission denied)) = 50

Looks like the kernel to me. This is using the lspp.16 kernel.

-Steve

Re: Watch problems

[Linda Knippers]

This reminds me of the "4500 watches" bug.
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=172574

For me, everything worked fine when I had about 40 watches.
Then I loaded about 150 more and I can't list them (I get
the same error you do) but the watches do seem to be working.
I can continue to add them and it doesn't seem to matter where
the files are.

-- ljk

Steve Grubb wrote:
> Hi,
> 
> I was testing the new watch system and ran across some problems. When I loaded 
> 85 watches + 10 syscall rules, I got this when trying to list them back out:
> 
> [root@localhost watch-perf]# auditctl -l
> Error receiving audit netlink packet (No buffer space available)
> Error sending rule list request (No buffer space available)
> 
> And when I try to add a watch against a file in my home directory, I get this:
> 
> [root@localhost watch-perf]# auditctl -w /root/test/watch-perf/error.txt
> Error sending add rule request (Permission denied)
> 
> If I move the same file to /etc, it works fine. I ran strace to see where this 
> is coming from:
> 
> sendto(3, "@\4\0\0\363\3\5\0\1\0\0\0\0\0\0\0\4\0\0\0\2\0\0\0\1\0\0"..., 1088,
> 0, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 1088
> poll([{fd=3, events=POLLIN, revents=POLLIN}], 1, 100) = 1
> recvfrom(3, "$\0\0\0\2\0\0\0\1\0\0\0\261\10\0\0\363\377\377\377@\4\0"...,
> 8476,
> MSG_PEEK|MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) =
> 36
> recvfrom(3, "$\0\0\0\2\0\0\0\1\0\0\0\261\10\0\0\363\377\377\377@\4\0"...,
> 8476,
> MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 36
> write(2, "Error sending add rule request ("..., 50Error sending add rule
> request (Permission denied)) = 50
> 
> Looks like the kernel to me. This is using the lspp.16 kernel.
> 
> -Steve
> 
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit
>