On Tue, 6 May 2014 14:50:05 +0000 Fiedler Roman <Roman.Fiedler@ait.ac.at> wrote: > Hello List, > > I've observed, that adding audit rules on vserver kernels does not work. > Since this failure is not logged at any prominent position, I haven't > noticed it till now and I'm not sure when this problem might have first > occurred (A quick check showed, that it is present since at least > 3.13.5-vs2.3.6.11 on amd64). > > Since this is working on Ubuntu stock kernels, I also do not know, if the > problem was introduced by using problematic kernel configuration on my side > of if it might be really vserver specific. > > Could someone with an own build of vserver kernel please test if auditctl > works on his system? > > # apt-get install auditd > # auditctl -l > No rules > # auditctl -a exit,always -F arch=b32 -S unlink -S rmdir > Error sending add rule request (Operation not supported) # uname -a Linux debian-wheezy-server 3.10.39-vs2.3.6.8+1-amd64 #1 SMP Tue May 6 23:23:27 UTC 2014 x86_64 GNU/Linux # cat /etc/debian_version 7.3 # grep AUDIT /boot/config-3.10.39-vs2.3.6.8+1-amd64 CONFIG_AUDIT_ARCH=y CONFIG_AUDIT=y CONFIG_AUDITSYSCALL=y CONFIG_AUDIT_WATCH=y CONFIG_AUDIT_TREE=y # CONFIG_AUDIT_LOGINUID_IMMUTABLE is not set CONFIG_NETFILTER_XT_TARGET_AUDIT=m CONFIG_SECURITY_TOMOYO_MAX_AUDIT_LOG=1024 # CONFIG_KVM_MMU_AUDIT is not set i ran your specified commands (apt-get... auditctl...) and got the same error. so that's another data point for you (though i don't know if that helps you determine where the problem is, except that it isn't specific to 3.13). corey -- undefined@pobox.com > Kind regards, > Roman