Re: operation not supported on filtering

From: Steve Grubb <sgrubb@redhat.com>
To: Vincent Fiset <vfiset@gmail.com>
Cc: linux-audit@redhat.com
Subject: Re: operation not supported on filtering
Date: Tue, 04 Dec 2018 11:09:34 -0500	[thread overview]
Message-ID: <2573614.8dN3b8yfxt@x2> (raw)
In-Reply-To: <CA+P2B3betw+VJrbUbANZCg=w-fPJ_B6VahFuqK9OpfjpzK5gdQ@mail.gmail.com>

On Tuesday, December 4, 2018 10:15:47 AM EST Vincent Fiset wrote:
> > strace /sbin/auditctl -a always,exclude -F msgtype=CWD  >  log  2>&1
> 
> Unfortunately I already tried that before, strace was not revealing
> anything obvious (for me at least)

There's info in there.

> sendto(4,
> "\34\3\0\0\353\3\5\0\2\0\0\0\0\0\0\0\5\0\0\0\2\0\0\0\1\0\0\0\377\377\377\3
> 77"..., 796, 0, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 796
> poll([{fd=4, events=POLLIN}], 1, 500)   = 1 ([{fd=4, revents=POLLIN}])
> recvfrom(4,
> "0\3\0\0\2\0\0\0\2\0\0\0\355h\0\0\241\377\377\377\34\3\0\0\353\3\5\0\2\0\0
> \0"..., 8988, MSG_PEEK|MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0,
> groups=00000000}, [12]) = 816
> recvfrom(4,
> "0\3\0\0\2\0\0\0\2\0\0\0\355h\0\0\241\377\377\377\34\3\0\0\353\3\5\0\2\0\0
> \0"..., 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000},

This ^^^ is the part to interpret:

0\3\0\0\ - length
2\0 - msg type NLMSG_ERROR
\0\0 - flags
\2\0\0\0 - seq number
\355h\0\0\0 - pid 
\241\377\377\377 - errno EOPNOTSUPP

So...your kernel is not supporting this. You'd need to dig through the kernel 
source to find this. I don't think I can help much past this point as I'm not 
familiar with the Debian kernels.

-Steve