Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-70455

Audit - rules cannot be loaded

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Normal Normal
    • rhel-9.6
    • rhel-9.6
    • audit
    • None
    • audit-3.1.5-2.el9
    • Yes
    • Moderate
    • rhel-sst-security-special-projects
    • ssg_security
    • 26
    • 1
    • False
    • Hide

      None

      Show
      None
    • No
    • None
    • Unspecified Release Note Type - Unknown
    • aarch64
    • None

      What were you trying to do that didn't work?

      Augenrules --load will fail.

       

       

      :: [ 12:11:01 ] :: [   FAIL   ] :: File '/var/tmp/rlRun_LOG.uHxx23MZ' should not contain 'FAILURE' 
:: [ 12:11:01 ] :: [  BEGIN   ] :: Running 'augenrules --load'
/usr/sbin/augenrules: No change
No rules
enabled 1
failure 1
pid 6310
rate_limit 0
backlog_limit 8192
lost 0
backlog 4
backlog_wait_time 60000
backlog_wait_time_actual 0
enabled 1
failure 1
pid 6310
rate_limit 0
backlog_limit 8192
lost 0
backlog 0
backlog_wait_time 60000
backlog_wait_time_actual 0
enabled 1
failure 1
pid 6310
rate_limit 0
backlog_limit 8192
lost 0
backlog 0
backlog_wait_time 60000
backlog_wait_time_actual 0
Syscall name unknown: rename
Error adding syscalls for perm filtering
There was an error in line 14 of /etc/audit/audit.rules
:: [ 12:11:01 ] :: [   FAIL   ] :: Command 'augenrules --load' (Expected 0, got 1)

       

      This PR, could fix issue: https://github.com/linux-audit/audit-userspace/pull/397 

       

      What is the impact of this issue to you?

      Test failed.

      Please provide the package NVR for which the bug is seen:

      audit-3.1.5-1.el9.aarch64

      How reproducible is this bug?:

      Always

      Steps to reproduce

      1. git clone https://gitlab.cee.redhat.com/special-projects/tests/audit.git
      1. reserve RHEL-9.6 machine with aarch64
      2. run in cloned dir
       tmt --context distro=RHEL-9.6 run plan --default -vvv prepare discover -h fmf -t /Sanity/bz1985630-audit-shipped-rules -vv provision -h connect -g 10.31.45.8 execute --how tmt --interactive login report --how junit finish -vvv   

      Expected results

      Augenrules will load succesfully.

      Actual results

      Augenrules load failed.

       

       

      [1]  https://artifacts.osci.redhat.com/testing-farm/f6e35922-8aa6-4fcc-99bc-c9489669e9fe/work-e2e_internalh4cvyl4q/ci_tests/e2e_internal/execute/data/guest/default-0/Sanity/bz1985630-audit-shipped-rules-21/output.txt 

              rh-ee-alakatos Attila Lakatos
              pkoncity2 Patrik Končitý
              Sergio Correia Sergio Correia
              SSG Security QE SSG Security QE
              Votes:
              0 Vote for this issue
              Watchers:
              7 Start watching this issue

                Created:
                Updated: