Watch problems

[Steve Grubb]

Hi,

I was testing the new watch system and ran across some problems. When I loaded 
85 watches + 10 syscall rules, I got this when trying to list them back out:

[root at localhost watch-perf]# auditctl -l
Error receiving audit netlink packet (No buffer space available)
Error sending rule list request (No buffer space available)

And when I try to add a watch against a file in my home directory, I get this:

[root at localhost watch-perf]# auditctl -w /root/test/watch-perf/error.txt
Error sending add rule request (Permission denied)

If I move the same file to /etc, it works fine. I ran strace to see where this 
is coming from:

sendto(3, "@\4\0\0\363\3\5\0\1\0\0\0\0\0\0\0\4\0\0\0\2\0\0\0\1\0\0"..., 1088,
0, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 1088
poll([{fd=3, events=POLLIN, revents=POLLIN}], 1, 100) = 1
recvfrom(3, "$\0\0\0\2\0\0\0\1\0\0\0\261\10\0\0\363\377\377\377@\4\0"...,
8476,
MSG_PEEK|MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) =
36
recvfrom(3, "$\0\0\0\2\0\0\0\1\0\0\0\261\10\0\0\363\377\377\377@\4\0"...,
8476,
MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 36
write(2, "Error sending add rule request ("..., 50Error sending add rule
request (Permission denied)) = 50

Looks like the kernel to me. This is using the lspp.16 kernel.

-Steve