Re: Double addition of rule yields two log messages

[Michael C Thompson <thompsmc@us.ibm.com>]

Linda Knippers wrote:
> Michael C Thompson wrote:
>> Hey all,
>>
>> Adding a rule successfully (i.e. not malformed and that rule didn't
>> already exist) creates a log entry:
>> type=CONFIG_CHANGE msg=audit(1147986115.721:28510): auid=0
>> subj=root:staff_r:staff_t:s0-s15:c0.c255 add rule to list=2 res=0
>>
>> Then, adding the same rule again will resulting in an error message
>> being reported to the user saying that rule exists (although it uses the
>> work "File exists", which if that could be changed to "Rule exists",
>> might be nice). However, despite this apparent failure, we get a log entry:
>> type=CONFIG_CHANGE msg=audit(1147986117.389:28511): auid=0
>> subj=root:staff_r:staff_t:s0-s15:c0.c255 add rule to list=2 res=0
>>
>> Most FYI, not sure if this is a problem or not.
> 
> That's interesting.  When I do this sequence with the .22 kernel
> and the 1.2.1 tools:
> 
> # auditctl -a entry,always -S all -F pid=1005
> # auditctl -a entry,always -S all -F pid=1005
> Error sending add rule request (File exists)
> 
> I get these records:
> 
> type=CONFIG_CHANGE msg=audit(1148054817.056:575): auid=500
> subj=user_u:system_r:auditctl_t:s0-s0:c0.c255 add rule to list=2 res=1
> type=CONFIG_CHANGE msg=audit(1148054831.417:576): auid=500
> subj=user_u:system_r:auditctl_t:s0-s0:c0.c255 add rule to list=2 res=0
> 
> I believe res=1 means the operation was successful and the res=0 means
> it failed.  Are you sure one of your records doesn't have res=1?

Yes, you are infact correct. I missed that with my testing. 1 for the 
first entry, 0 for all subsequent doubles.

> I don't know what the "add rule to list=2" means though.

list=2 means that it was added to the entry list, now the CONFIG_CHANGE 
messages tell you which filter list it was added to. 2 == entry, 5 == 
exclude, etc.

> 
> What is the exact rule you're adding?  And which kernel/tools are you
> running?

auditctl -a entry,always -S chmod -F se_sen=s0-s15:c
However, the action seems to be independent of the rule. The audit is 
1.2.2 and 25 kernel.

Thanks,
Mike