audit rules are not listed as configured
Issue
- Additional syscall are appended to audit rules. For example, if I set an audit rule with:
# auditctl -a always,exit -F arch=b64 -S creat -F path=/etc/ssh/sshd_config -F perm=wa
auditctl -l will display it differently as below:
# auditctl -l
-a always,exit -F arch=b64 -S open,bind,truncate,ftruncate,rename,mkdir,rmdir,creat,link,unlink,symlink,chmod,fchmod,chown,fchown,lchown,mknod,acct,swapon,quotactl,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr,openat,mkdirat,mknodat,fchownat,unlinkat,renameat,linkat,symlinkat,fchmodat,fallocate,renameat2,openat2 -F path=/etc/ssh/sshd_config -F perm=wa
Environment
- RHEL 9.5
- audit 3.1.3 and later
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.