SOFTWARE_UPDATE on RHEL 7.6

Steve Grubb sgrubb at redhat.com
Wed Aug 29 18:34:39 UTC 2018


Hello,

On Wednesday, August 29, 2018 9:53:05 AM EDT Maupertuis Philippe wrote:
> I have tried to get the SOFTWARE_UPDATE events on a new RHEL 7.6 beta 1
> with audit rebased on 2.8.4 When installing a new rpm I get the
> corresponding event.
> The text format is very easily readable  :)
> Unfortunately when I remove the package I get nothing.
> Is it the intending behavior ?

Yes. That is the intended behavior. If package removal events are desired, a 
bug report may be filed. OSPP v4.2 requirements are concerned about software 
being installed and upgraded. It is silent on software removal.
 
> If updates are pushed through Redhat satellite or  Spacewalk would I get
> the event ?

The patch is in librpm, so it should be recorded by anything that uses it.

-Steve





More information about the Linux-audit mailing list