augenrules --load returns 1 when auditd is in immutable mode

Solution Verified - Updated -

Issue

  • augenrules --load exit with 1 if auditd is in immutable mode. Until the previous version 3.0.7, it used to return 0:

    [root@rh810-01 ~]# auditctl -s
    enabled 2
    failure 1
    pid 760
    rate_limit 0
    backlog_limit 8192
    lost 0
    backlog 0
    backlog_wait_time 60000
    backlog_wait_time_actual 0
    loginuid_immutable 0 unlocked
    [root@rh810-01 ~]# augenrules --load
    /usr/sbin/augenrules: No change
    [root@rh810-01 ~]# echo $?
    1
    

Environment

  • RHEL 8.10 and 9.4
  • audit-3.1.2

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content