With my patch: antarus@goats2 /tmp $ ./foo 45531 0 LIST_RULES: exit,always dir=/etc/audit (0xa) perm=wa key=etc_audit LIST_RULES: exit,always watch=/etc/default/auditd perm=wa key=etc_default_auditd LIST_RULES: exit,always watch=/etc/init.d/auditd perm=wa key=etc_init.d_auditd LIST_RULES: exit,always watch=/etc/libaudit.conf perm=wa key=etc_libaudit.conf LIST_RULES: exit,always dir=/etc/audisp (0xb) perm=wa key=etc_audisp LIST_RULES: exit,always watch=/etc/ssh/ssh_config perm=wa key=ssh LIST_RULES: exit,always watch=/etc/ssh/sshd_config perm=wa key=ssh LIST_RULES: exit,always watch=/etc/ssh/ssh_host_dsa_key perm=wa key=ssh LIST_RULES: exit,always watch=/etc/ssh/ssh_host_rsa_key perm=wa key=ssh LIST_RULES: exit,always watch=/etc/ssh/ssh_host_key perm=wa key=ssh LIST_RULES: exit,always watch=/etc/shadow perm=wa key=password LIST_RULES: exit,always watch=/dev/mem perm=wa key=kernel LIST_RULES: exit,always arch=3221225534 (0xc000003e) filetype=32768 (0x8000) a1&3072 (0xc00) key=chmod syscall=chmod,fchmod LIST_RULES: exit,always arch=3221225534 (0xc000003e) filetype=32768 (0x8000) a2&3072 (0xc00) key=chmod syscall=fchmodat
-- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/957519 Title: auditctl uses wrong syscall to determine uid To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/audit/+bug/957519/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
