Re: Double addition of rule yields two log messages

[Linda Knippers <linda.knippers@hp.com>]

Michael C Thompson wrote:
> Hey all,
> 
> Adding a rule successfully (i.e. not malformed and that rule didn't
> already exist) creates a log entry:
> type=CONFIG_CHANGE msg=audit(1147986115.721:28510): auid=0
> subj=root:staff_r:staff_t:s0-s15:c0.c255 add rule to list=2 res=0
> 
> Then, adding the same rule again will resulting in an error message
> being reported to the user saying that rule exists (although it uses the
> work "File exists", which if that could be changed to "Rule exists",
> might be nice). However, despite this apparent failure, we get a log entry:
> type=CONFIG_CHANGE msg=audit(1147986117.389:28511): auid=0
> subj=root:staff_r:staff_t:s0-s15:c0.c255 add rule to list=2 res=0
> 
> Most FYI, not sure if this is a problem or not.

That's interesting.  When I do this sequence with the .22 kernel
and the 1.2.1 tools:

# auditctl -a entry,always -S all -F pid=1005
# auditctl -a entry,always -S all -F pid=1005
Error sending add rule request (File exists)

I get these records:

type=CONFIG_CHANGE msg=audit(1148054817.056:575): auid=500
subj=user_u:system_r:auditctl_t:s0-s0:c0.c255 add rule to list=2 res=1
type=CONFIG_CHANGE msg=audit(1148054831.417:576): auid=500
subj=user_u:system_r:auditctl_t:s0-s0:c0.c255 add rule to list=2 res=0

I believe res=1 means the operation was successful and the res=0 means
it failed.  Are you sure one of your records doesn't have res=1?
I don't know what the "add rule to list=2" means though.

What is the exact rule you're adding?  And which kernel/tools are you
running?

BTW, with RHEL4U2 we only got a record on the success case.
type=CONFIG_CHANGE msg=audit(1148054734.395:10530): auid=500 added an
audit rule

-- ljk