Re: [vserver] Searching for source of auditd related problem

From: Corey Wright <undefined_at_pobox.com>
Date: Wed 07 May 2014 - 02:34:09 BST
Message-Id: <20140506203409.6a60654a7f586ac55b377107@pobox.com>

On Tue, 6 May 2014 14:50:05 +0000
Fiedler Roman <Roman.Fiedler@ait.ac.at> wrote:

> Hello List,
>
> I've observed, that adding audit rules on vserver kernels does not work.
> Since this failure is not logged at any prominent position, I haven't
> noticed it till now and I'm not sure when this problem might have first
> occurred (A quick check showed, that it is present since at least
> 3.13.5-vs2.3.6.11 on amd64).
>
> Since this is working on Ubuntu stock kernels, I also do not know, if the
> problem was introduced by using problematic kernel configuration on my side
> of if it might be really vserver specific.
>
> Could someone with an own build of vserver kernel please test if auditctl
> works on his system?
>
> # apt-get install auditd
> # auditctl -l
> No rules
> # auditctl -a exit,always -F arch=b32 -S unlink -S rmdir
> Error sending add rule request (Operation not supported)

# uname -a
Linux debian-wheezy-server 3.10.39-vs2.3.6.8+1-amd64 #1 SMP Tue May 6
23:23:27 UTC 2014 x86_64 GNU/Linux
# cat /etc/debian_version
7.3
# grep AUDIT /boot/config-3.10.39-vs2.3.6.8+1-amd64
CONFIG_AUDIT_ARCH=y
CONFIG_AUDIT=y
CONFIG_AUDITSYSCALL=y
CONFIG_AUDIT_WATCH=y
CONFIG_AUDIT_TREE=y
# CONFIG_AUDIT_LOGINUID_IMMUTABLE is not set
CONFIG_NETFILTER_XT_TARGET_AUDIT=m
CONFIG_SECURITY_TOMOYO_MAX_AUDIT_LOG=1024
# CONFIG_KVM_MMU_AUDIT is not set

i ran your specified commands (apt-get... auditctl...) and got the same error.

so that's another data point for you (though i don't know if that helps you
determine where the problem is, except that it isn't specific to 3.13).

corey

--
undefined@pobox.com
> Kind regards,
> Roman
Received on Wed May 7 02:33:55 2014
[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Wed 07 May 2014 - 02:33:55 BST by hypermail 2.1.8