On Tue, 6 May 2014 14:50:05 +0000
Fiedler Roman <Roman.Fiedler@ait.ac.at> wrote:
> Hello List,
> I've observed, that adding audit rules on vserver kernels does not work.
> Since this failure is not logged at any prominent position, I haven't
> noticed it till now and I'm not sure when this problem might have first
> occurred (A quick check showed, that it is present since at least
> 3.13.5-vs18.104.22.168 on amd64).
> Since this is working on Ubuntu stock kernels, I also do not know, if the
> problem was introduced by using problematic kernel configuration on my side
> of if it might be really vserver specific.
> Could someone with an own build of vserver kernel please test if auditctl
> works on his system?
> # apt-get install auditd
> # auditctl -l
> No rules
> # auditctl -a exit,always -F arch=b32 -S unlink -S rmdir
> Error sending add rule request (Operation not supported)
# uname -a
Linux debian-wheezy-server 3.10.39-vs22.214.171.124+1-amd64 #1 SMP Tue May 6
23:23:27 UTC 2014 x86_64 GNU/Linux
# cat /etc/debian_version
# grep AUDIT /boot/config-3.10.39-vs126.96.36.199+1-amd64
# CONFIG_AUDIT_LOGINUID_IMMUTABLE is not set
# CONFIG_KVM_MMU_AUDIT is not set
i ran your specified commands (apt-get... auditctl...) and got the same error.
so that's another data point for you (though i don't know if that helps you
determine where the problem is, except that it isn't specific to 3.13).
-- email@example.com > Kind regards, > RomanReceived on Wed May 7 02:33:55 2014