operation not supported on filtering

[Vincent Fiset]

I got a minimal audit.rules file containing:

# cat -n /etc/audit/audit.rules
1 -D
2
3 -b 8192
4
5 -e 0
6
7 -a always,exclude -F msgtype=CWD
8
9 -w /etc/sysctl.conf -p wa -k sysctl

When I restart auditd I get:

# /etc/init.d/auditd restart
Restarting audit daemon: auditd Error sending add rule request
(Operation not supported)
There was an error in line 7 of /etc/audit/audit.rules
failed!

instructions like `-a always,exclude -F msgtype=CWD` seems to be very
popular in example all over the internet. I don't understand why I get the
error.

I use auditd `1:1.7.18-1.1` on debian 7

What should I do to make this filter work?

[Steve Grubb]

Post by Vincent Fiset
# cat -n /etc/audit/audit.rules
1 -D
2
3 -b 8192
4
5 -e 0

Why are you ^^^ disabling the audit system? You may want to try commenting
that out.

Post by Vincent Fiset
7 -a always,exclude -F msgtype=CWD
8
9 -w /etc/sysctl.conf -p wa -k sysctl
# /etc/init.d/auditd restart
Restarting audit daemon: auditd Error sending add rule request
(Operation not supported)
There was an error in line 7 of /etc/audit/audit.rules
failed!
instructions like `-a always,exclude -F msgtype=CWD` seems to be very
popular in example all over the internet. I don't understand why I get the
error.
I use auditd `1:1.7.18-1.1` on debian 7
What should I do to make this filter work?

Support for msgtype on the exclude filter goes all the way back to 2005. So,
it should work unless the kernel was built without audit full support. It
might also be that if the audit system is disabled, it won't load rules. So,
I'd try that. The code is very old and behaviors have changed over the years
(both kernel and user space).

-Steve

[Vincent Fiset]

Post by Steve Grubb

Post by Vincent Fiset
# cat -n /etc/audit/audit.rules
1 -D
2
3 -b 8192
4
5 -e 0

Why are you ^^^ disabling the audit system? You may want to try commenting
that out.

I tired to add that to make sure it was not preventing me to add the
filters on msgtype. Normally I use `-e 1`

Post by Steve Grubb

Post by Vincent Fiset
7 -a always,exclude -F msgtype=CWD
8
9 -w /etc/sysctl.conf -p wa -k sysctl
# /etc/init.d/auditd restart
Restarting audit daemon: auditd Error sending add rule request
(Operation not supported)
There was an error in line 7 of /etc/audit/audit.rules
failed!
instructions like `-a always,exclude -F msgtype=CWD` seems to be very
popular in example all over the internet. I don't understand why I get the
error.
I use auditd `1:1.7.18-1.1` on debian 7
What should I do to make this filter work?

Support for msgtype on the exclude filter goes all the way back to 2005. So,
it should work unless the kernel was built without audit full support. It
might also be that if the audit system is disabled, it won't load rules. So,
I'd try that. The code is very old and behaviors have changed over the years
(both kernel and user space).

Thanks for the input on that I will try to figure out how to determine
if it was built with audit full support. Any tips on how to achieve
that are welcome.