#758489 auditd: Error sending add rule request (Operation not supported)

Package:
auditd
Source:
audit
Description:
User space tools for security auditing
Submitter:
root
Date:
2014-09-16 18:51:11 UTC
Severity:
important
#758489#5
Date:
2014-08-18 02:24:34 UTC
From:
To:
Dear Maintainer,
*** Please consider answering these questions, where appropriate ***

   * What led up to the situation?
		After upgrading the kernel audit rules are no longer accepted / applied.
		Attempted audit rules:
			-a exit,always -F arch=b64 -S execve
			-a exit,always -F arch=b32 -S execve


   * What exactly did you do (or not do) that was effective (or
     ineffective)?
			Reboot w/ older kernel and everything works fine.

	* What was the outcome of this action?
			Works with older kernel:
				Debian 3.2.60-1+deb7u3 x86_64
		 but not with anything newer.

 * What outcome did you expect instead?
	Was expecting auditctl -l to list the rules specified in /etc/audit/audit.rules OR in case of newer package /etc/audit/rules.d/audit.rules.dpkg-new
	OR for " auditctl -a exit,always -F arch=b64 -S execve " to not return " Error sending add rule request (Operation not supported) "


*** End of the template - remove these lines ***
#758489#10
Date:
2014-09-07 15:11:23 UTC
From:
To:
On Sun, 17 Aug 2014 19:24:34 -0700 root <vmixus@gmail.com> wrote:

Hello,

Are you sure about the version of audit you are currently running?

Wheezy currently has 1:1.7.18-1.1 and I'm not sure this version is
working with 3.14, it would probably require a backport of a more
recent version.


[...]
[...]

This is actually really weird. I doubt this would ever work.

Cheers,

Laurent Bigonville