Date: Wed, 18 Jul 2012 13:10:39 GMT From: Shawn Webb <lattera@gmail.com> To: freebsd-gnats-submit@FreeBSD.org Subject: misc/169971: auditd does not reload rules Message-ID: <201207181310.q6IDAdBO065237@red.freebsd.org> Resent-Message-ID: <201207181320.q6IDK1KP041822@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 169971 >Category: misc >Synopsis: auditd does not reload rules >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Wed Jul 18 13:20:01 UTC 2012 >Closed-Date: >Last-Modified: >Originator: Shawn Webb >Release: FreeBSD 9-STABLE >Organization: >Environment: FreeBSD wyze 9.0-STABLE FreeBSD 9.0-STABLE #0 r237267+5c58562: Fri Jul 6 11:14:31 EDT 2012 shawn@wyze:/usr/obj/usr/src/sys/SEC amd64 >Description: Editing the audit_control file (and audit_user file) and restarting or syncing auditd does not reload the rules. >How-To-Repeat: 1) Start auditd: /etc/rc.d/auditd start 2) Edit /etc/security/audit_control and put a different value in for the "flags" variable (or naflags) 3) Restart auditd: /etc/rc.d/auditd restart 3.1) Or sync auditd: auditd -s 4) Watch as the new rules are not applied >Fix: >Release-Note: >Audit-Trail: >Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201207181310.q6IDAdBO065237>