Linux-audit Archive on lore.kernel.org
 help / color / Atom feed
* Error handling of auditctl -w
@ 2020-06-16 20:00 Stefan Tauner
  2020-06-18 23:54 ` Lenny Bruzenak
  2020-06-21 18:38 ` Steve Grubb
  0 siblings, 2 replies; 3+ messages in thread
From: Stefan Tauner @ 2020-06-16 20:00 UTC (permalink / raw)
  To: linux-audit

Hi,

I was wondering why my auditctl executions do not print any errors but
apparently didn't do anything. After checking the return value (which
was 255) I looked at the code and noticed that audit_setup_perms() and
audit_update_watch_perms() have virtually no user-visible error reporting.

-- 
Kind regards/Mit freundlichen Grüßen, Stefan Tauner


--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit

^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: Error handling of auditctl -w
  2020-06-16 20:00 Error handling of auditctl -w Stefan Tauner
@ 2020-06-18 23:54 ` Lenny Bruzenak
  2020-06-21 18:38 ` Steve Grubb
  1 sibling, 0 replies; 3+ messages in thread
From: Lenny Bruzenak @ 2020-06-18 23:54 UTC (permalink / raw)
  To: linux-audit

On 6/16/20 2:00 PM, Stefan Tauner wrote:

> Hi,
>
> I was wondering why my auditctl executions do not print any errors but
> apparently didn't do anything. After checking the return value (which
> was 255) I looked at the code and noticed that audit_setup_perms() and
> audit_update_watch_perms() have virtually no user-visible error reporting.

Are these in a rules file? I was thinking about perhaps a previous "-i" 
(i.e. auditctl -i) preceeded your rule, however the man page says it 
always returns a success code.

So probably not that, unless the man page doesn't match reality. Can you 
provide a little more detail (e.g. parameters)?

Thx,

LCB

-- 
Lenny Bruzenak
MagitekLTD

--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit


^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: Error handling of auditctl -w
  2020-06-16 20:00 Error handling of auditctl -w Stefan Tauner
  2020-06-18 23:54 ` Lenny Bruzenak
@ 2020-06-21 18:38 ` Steve Grubb
  1 sibling, 0 replies; 3+ messages in thread
From: Steve Grubb @ 2020-06-21 18:38 UTC (permalink / raw)
  To: linux-audit; +Cc: Stefan Tauner

Hello,

On Tuesday, June 16, 2020 4:00:17 PM EDT Stefan Tauner wrote:
> I was wondering why my auditctl executions do not print any errors but
> apparently didn't do anything. After checking the return value (which
> was 255) I looked at the code and noticed that audit_setup_perms() and
> audit_update_watch_perms() have virtually no user-visible error reporting.

Git commit 4a2b9fd should fix this. Thanks for reporting it!

-Steve



--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit


^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, back to index

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-06-16 20:00 Error handling of auditctl -w Stefan Tauner
2020-06-18 23:54 ` Lenny Bruzenak
2020-06-21 18:38 ` Steve Grubb

Linux-audit Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-audit/0 linux-audit/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-audit linux-audit/ https://lore.kernel.org/linux-audit \
		linux-audit@redhat.com
	public-inbox-index linux-audit

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/com.redhat.linux-audit


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git