<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML><HEAD> <META http-equiv=Content-Type content="text/html; charset=iso-8859-1"> <META content="MSHTML 6.00.6000.16414" name=GENERATOR> <STYLE></STYLE> </HEAD> <BODY bgColor=#d8d0c8> <DIV><FONT face=Arial size=2>All:</FONT></DIV> <DIV><FONT face=Arial size=2></FONT> </DIV> <DIV><FONT face=Arial size=2>When using linux kernel-smp-2.6.9-42.0.10.EL and audit-1.0.14-1.EL</FONT></DIV> <DIV><FONT face=Arial size=2></FONT> </DIV> <DIV><FONT face=Arial size=2>In the audit.rules files</FONT></DIV> <DIV><FONT face=Arial size=2></FONT> </DIV> <DIV><FONT face=Arial size=2>-a entry, always -S chmod</FONT></DIV> <DIV><FONT face=Arial size=2></FONT> </DIV> <DIV><FONT face=Arial size=2>errors out. Does not recognize 'chmod'.</FONT></DIV> <DIV><FONT face=Arial size=2></FONT> </DIV> <DIV><FONT face=Arial size=2>It works in kernel-smp-2.6.9-42.EL given the same audit rpm</FONT></DIV> <DIV><FONT face=Arial size=2></FONT> </DIV> <DIV><FONT face=Arial size=2>Is the syscalls list for 2.6.9-42.0.10.EL radically different, and if so, is there a list of the syscalls available for audit somewhere?</FONT></DIV> <DIV><FONT face=Arial size=2></FONT> </DIV> <DIV><FONT face=Arial size=2></FONT> </DIV></BODY></HTML>