Error handling of auditctl -w

Error handling of auditctl -w

[Stefan Tauner]

Hi,

I was wondering why my auditctl executions do not print any errors but
apparently didn't do anything. After checking the return value (which
was 255) I looked at the code and noticed that audit_setup_perms() and
audit_update_watch_perms() have virtually no user-visible error reporting.

-- 
Kind regards/Mit freundlichen Grüßen, Stefan Tauner


--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit

Re: Error handling of auditctl -w

[Lenny Bruzenak]

On 6/16/20 2:00 PM, Stefan Tauner wrote:

> Hi,
>
> I was wondering why my auditctl executions do not print any errors but
> apparently didn't do anything. After checking the return value (which
> was 255) I looked at the code and noticed that audit_setup_perms() and
> audit_update_watch_perms() have virtually no user-visible error reporting.

Are these in a rules file? I was thinking about perhaps a previous "-i" 
(i.e. auditctl -i) preceeded your rule, however the man page says it 
always returns a success code.

So probably not that, unless the man page doesn't match reality. Can you 
provide a little more detail (e.g. parameters)?

Thx,

LCB

-- 
Lenny Bruzenak
MagitekLTD

--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit

Re: Error handling of auditctl -w

[Steve Grubb]

Hello,

On Tuesday, June 16, 2020 4:00:17 PM EDT Stefan Tauner wrote:
> I was wondering why my auditctl executions do not print any errors but
> apparently didn't do anything. After checking the return value (which
> was 255) I looked at the code and noticed that audit_setup_perms() and
> audit_update_watch_perms() have virtually no user-visible error reporting.

Git commit 4a2b9fd should fix this. Thanks for reporting it!

-Steve



--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit