On 2025-08-06 21:47, Paul Moore wrote: > On Aug 6, 2025 Richard Guy Briggs <[email protected]> wrote: > > > > When no audit rules are in place, fanotify event results are > > unconditionally dropped due to an explicit check for the existence of > > any audit rules. Given this is a report from another security > > sub-system, allow it to be recorded regardless of the existence of any > > audit rules. > > > > To test, install and run the fapolicyd daemon with default config. Then > > as an unprivileged user, create and run a very simple binary that should > > be denied. Then check for an event with > > ausearch -m FANOTIFY -ts recent > > > > Link: https://issues.redhat.com/browse/RHEL-9065 > > Signed-off-by: Richard Guy Briggs <[email protected]> > > --- > > changelog: > > v2 > > - re-add audit_enabled check > > --- > > include/linux/audit.h | 2 +- > > 1 file changed, 1 insertion(+), 1 deletion(-) > > Merged into audit/dev-staging with the plan being to merge it to > audit/dev once the merge window closes.
Thanks Paul. > paul-moore.com - RGB -- Richard Guy Briggs <[email protected]> Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, Ottawa, Red Hat Canada Upstream IRC: SunRaycer Voice: +1.613.860 2354 SMS: +1.613.518.6570
