Subject: Re: [vserver] Searching for source of auditd related problem
From: Fiedler Roman <Roman.Fiedler@ait.ac.at>
Date: Thu, 8 May 2014 09:18:53 +0000
Thu, 8 May 2014 09:18:53 +0000
> Von: Fiedler Roman [mailto:Roman.Fiedler@ait.ac.at]
> 
> > Von: Corey Wright [mailto:undefined@pobox.com]
> >
> > On Tue, 6 May 2014 14:50:05 +0000
> > Fiedler Roman <Roman.Fiedler@ait.ac.at> wrote:
> >
> > > Hello List,
> > >
> > > I've observed, that adding audit rules on vserver kernels does not
work.
> > > Since this failure is not logged at any prominent position, I haven't
> > > noticed it till now and I'm not sure when this problem might have
first
> > > occurred (A quick check showed, that it is present since at least
> > > 3.13.5-vs2.3.6.11 on amd64).
>.....
> 
> Conclusio: do not use latest kernels with Ubuntu Precise (and most likely
> some other distros)

So it seems, that the audit tools use syscall API already deprecated back in
2006 and removed 2013. I've reported that (see [1]) because it is a little
pity, that the Ubuntu LTS 1204, which is supported till 2017 does not run on
kernels after 2013 due to issues from 2006.

Roman

[1] https://bugs.launchpad.net/bugs/1317188



["application/pkcs7-signature" not shown]