From mboxrd@z Thu Jan 1 00:00:00 1970 From: Linda Knippers Subject: Re: auditd/auditctl SLED10 Date: Fri, 21 Jul 2006 10:31:22 -0400 Message-ID: <44C0E53A.6020402@hp.com> References: <44BF8E4F.3000405@ornl.gov> <44BF9F0D.5010204@hp.com> <1153424647.7866.11.camel@willipl1-ld1.jhuapl.edu> <44BFE2C3.9050405@hp.com> <1153484085.7866.23.camel@willipl1-ld1.jhuapl.edu> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Return-path: Received: from mx1.redhat.com (mx1.redhat.com [172.16.48.31]) by int-mx1.corp.redhat.com (8.12.11.20060308/8.12.11) with ESMTP id k6LEX105023031 for ; Fri, 21 Jul 2006 10:33:02 -0400 Received: from atlrel7.hp.com (atlrel7.hp.com [156.153.255.213]) by mx1.redhat.com (8.12.11.20060308/8.12.11) with ESMTP id k6LEX1O8017250 for ; Fri, 21 Jul 2006 10:33:01 -0400 In-Reply-To: <1153484085.7866.23.camel@willipl1-ld1.jhuapl.edu> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: lane.williams@jhuapl.edu Cc: Linux-audit@redhat.com List-Id: linux-audit@redhat.com Lane Williams wrote: > Yeah, I had tried that. There is an access syscall. From the looks of > things the audit version that comes with SuSE has a few problems. I > know in Red Hat it seems to work as I need it to. SuSE is also using > Apparmor in place of SELinux, or at least they make it appear that way. > The audit deamon also does not support file system watches. File system watches aren't supported in the upstream kernel until 2.6.18. > Seems the only success=no returns that I receive are when the file does > not exist. I may also have to add more to my filter in order to get > what I want. Unfortunately I am stuck with SuSE and will have to > continue troubleshooting until the patches come out. If you're using a 2.6.16 kernel and 1.1.3 audit tools, that seems like a mismatch. There was a 1.1.4 audit package released back in February and the release mail mentions apparmor support. https://www.redhat.com/archives/linux-audit/2006-February/msg00036.html You could try: http://people.redhat.com/sgrubb/audit/audit-1.1.4-1.src.rpm Good luck, -- ljk > > Thanks, > Lane >