<div dir="ltr"><span class="gmail-im" style="font-size:12.8px"><div class="gmail-m_3655370796696508323gmail_signature"><div dir="ltr"><div dir="ltr">On Sun, Oct 2, 2016 at 12:20 AM, Steve Grubb <span dir="ltr"><<a href="mailto:sgrubb@redhat.com" target="_blank">sgrubb@redhat.com</a>></span> wrote:<br></div></div></div></span><div class="gmail_quote" style="font-size:12.8px"><span class="gmail-im"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-m_3655370796696508323gmail-">On Saturday, October 1, 2016 5:47:47 PM EDT C.y wrote:<br>> Hi all,<br>><br>><br>> I have fedora-server-24 installed on my raspberry-pi-3, following the guide<br>> <a href="https://fedoraproject.org/wiki/Raspberry_Pi" rel="noreferrer" target="_blank">https://fedoraproject.org/wiki<wbr>/Raspberry_Pi</a>.<br>><br>> Once I get my raspberry pi boot up, there were error mentioning that "audit<br>> support not in kernel", which I believed were then resolved after I rebuild<br>> my kernel.<br>><br>> However, I got stuck when I tried to add rule using `auditctl` command as<br>> below:<br>> `# auditctl -w /etc/passwd -p wa -k passwd_changes`<br>> Error sending add rule data request (Invalid argument)<br><br></span>Hmm. I wonder if 'ausyscall open' gives you syscalls.</blockquote><div> </div></span><div>`# ausyscall open` returns as below. So I suppose the answer is yes?(correct me if I'm wrong)</div><div><div>open 5</div><div>mq_open 274</div><div>openat 322</div><div>perf_event_open 364</div><div>open_by_handle_at 371</div></div><span class="gmail-im"><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-m_3655370796696508323gmail-"><br>> I tried to search for solution but it lead me to a bug that were already<br>> been solved like years ago. Can anyone tell me if I am in the right way of<br>> getting auditd works on raspberry pi? Were the problem I've faced were<br>> already a known issue?<br>><br>> Below are my system information and some logs/details when I tried to<br>> diagnosis the problem and thanks a lot for your help in advance!<br>><br>> `# uname -a`<br>> Linux raspi3.lab 4.4.23-v7+ #2 SMP Sat Oct 1 15:24:41 CST 2016 armv7l<br>> armv7l armv7l GNU/Linux<br><br></span>I also wonder if we have a mismatch here. Is that armv seventy one or armv<br>seven-el? Its coded in audit as seventy one.</blockquote><div><br></div></span><div>It's 7-el.</div><div>`# uname -a | grep 7l` (7-el) returns</div><span class="gmail-im"><div>Linux raspi3.lab 4.4.23-v7+ #2 SMP Sat Oct 1 15:24:41 CST 2016 armv7l armv7l armv7l GNU/Linux<br></div><div><br></div></span><div><div><br class="gmail-m_3655370796696508323gmail-Apple-interchange-newline">Sincerly,</div><div>CHING YI.</div></div></div></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div>Sincerly,</div><div>CHING YI.<br></div></div></div></div></div></div> <br><div class="gmail_quote">On Sun, Oct 2, 2016 at 12:20 AM, Steve Grubb <span dir="ltr"><<a href="mailto:sgrubb@redhat.com" target="_blank">sgrubb@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On Saturday, October 1, 2016 5:47:47 PM EDT C.y wrote:<br> > Hi all,<br> ><br> ><br> > I have fedora-server-24 installed on my raspberry-pi-3, following the guide<br> > <a href="https://fedoraproject.org/wiki/Raspberry_Pi" rel="noreferrer" target="_blank">https://fedoraproject.org/<wbr>wiki/Raspberry_Pi</a>.<br> ><br> > Once I get my raspberry pi boot up, there were error mentioning that "audit<br> > support not in kernel", which I believed were then resolved after I rebuild<br> > my kernel.<br> ><br> > However, I got stuck when I tried to add rule using `auditctl` command as<br> > below:<br> > `# auditctl -w /etc/passwd -p wa -k passwd_changes`<br> > Error sending add rule data request (Invalid argument)<br> <br> </span>Hmm. I wonder if 'ausyscall open' gives you syscalls.<br> <span class=""><br> > I tried to search for solution but it lead me to a bug that were already<br> > been solved like years ago. Can anyone tell me if I am in the right way of<br> > getting auditd works on raspberry pi? Were the problem I've faced were<br> > already a known issue?<br> ><br> > Below are my system information and some logs/details when I tried to<br> > diagnosis the problem and thanks a lot for your help in advance!<br> ><br> > `# uname -a`<br> > Linux raspi3.lab 4.4.23-v7+ #2 SMP Sat Oct 1 15:24:41 CST 2016 armv7l<br> > armv7l armv7l GNU/Linux<br> <br> </span>I also wonder if we have a mismatch here. Is that armv seventy one or armv<br> seven-el? Its coded in audit as seventy one.<br> <span class="HOEnZb"><font color="#888888"><br> -Steve<br> </font></span><div class="HOEnZb"><div class="h5"><br> > `# modprobe configs ; gunzip -dc /proc/config.gz | grep AUDIT`<br> > CONFIG_AUDIT=y<br> > CONFIG_NETFILTER_XT_TARGET_<wbr>AUDIT=m<br> > CONFIG_AUDIT_GENERIC=y<br> > # CONFIG_AUDIT_ARCH_COMPAT_<wbr>GENERIC is not set<br> ><br> > `# systemctl status auditd.service`<br> > ● auditd.service - Security Auditing Service<br> > Loaded: loaded (/usr/lib/systemd/system/<wbr>auditd.service; enabled; vendor<br> > preset: enabled)<br> > Active: active (running) since Fri 2016-02-12 00:28:07 CST; 7 months 19<br> > days ago<br> > Process: 1553 ExecReload=/bin/kill -HUP $MAINPID (code=exited,<br> > status=0/SUCCESS)<br> > Process: 279 ExecStartPost=/sbin/augenrules --load (code=exited,<br> > status=1/FAILURE)<br> > Main PID: 278 (auditd)<br> > CGroup: /system.slice/auditd.service<br> > └─278 /sbin/auditd -n<br> ><br> > Oct 01 16:36:53 raspi3.lab auditd[278]: audit(1475311013.356:8458)<br> > op=reconfigure state=changed auid=4294967295 pid=-1 subj=? res=success<br> > Oct 01 16:36:53 raspi3.lab systemd[1]: Reloaded Security Auditing Service.<br> > Oct 01 16:37:28 raspi3.lab systemd[1]: Reloading Security Auditing Service.<br> > Oct 01 16:37:28 raspi3.lab auditd[278]: config change requested by pid=-1<br> > auid=4294967295 subj=?<br> > Oct 01 16:37:28 raspi3.lab auditd[278]: audit(1475311048.046:257)<br> > op=reconfigure state=changed auid=4294967295 pid=-1 subj=? res=success<br> > Oct 01 16:37:28 raspi3.lab systemd[1]: Reloaded Security Auditing Service.<br> > Oct 01 16:38:18 raspi3.lab systemd[1]: Reloading Security Auditing Service.<br> > Oct 01 16:38:18 raspi3.lab auditd[278]: config change requested by pid=-1<br> > auid=4294967295 subj=?<br> > Oct 01 16:38:18 raspi3.lab auditd[278]: audit(1475311098.716:2108)<br> > op=reconfigure state=changed auid=4294967295 pid=-1 subj=? res=success<br> > Oct 01 16:38:18 raspi3.lab systemd[1]: Reloaded Security Auditing Service.<br> ><br> > While my `/var/log/audit/audit.log` was full with lines of "SERVICE_START"<br> > & "SERVICE_STOP"<br> > type=SERVICE_START msg=audit(1475313700.696:276): pid=1 uid=0<br> > auid=4294967295 ses=4294967295 msg='unit=NetworkManager-<wbr>dispatcher<br> > comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=?<br> > res=success'<br> > type=SERVICE_STOP msg=audit(1475313710.836:277): pid=1 uid=0<br> > auid=4294967295 ses=4294967295 msg='unit=NetworkManager-<wbr>dispatcher<br> > comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=?<br> > res=success'<br> ><br> ><br> > Sincerly,<br> > CHING YI.<br> <br> <br> </div></div></blockquote></div><br></div>