Package: auditd Version: 1:4.0.2-2+b2 Followup-For: Bug #1111161 X-Debbugs-Cc: [email protected]
Dear Maintainer, Thanks for your last check-in. I think your last message was indicating that this was fixed (is that what "notfound" means?), but I've just downgraded my machine and re-tested 4.0.2-2+b2 on trixie/arm64, and it still has the same issue. Also, the Debian info page https://packages.debian.org/trixie/auditd seems to still only show a source-download link to [audit_4.0.2-2.debian.tar.xz] - and even trying a direct-edit url of http://deb.debian.org/debian/pool/main/a/audit/audit_4.0.2-2+b2.debian.tar.xz says 404 NotFound, so I can't seem to see the updated source either, to see if +b2 has the extra patch from upstream. Sample failing rule: -a always,exit -F arch=b64 -F path=/var/log/audit/ -F perm=r -F auid>=1000 -F auid!=unset -F key=10.2.3-access-audit-trail Result (during augenrules --load): Syscall name unknown: readlink Error adding syscalls for perm filtering There was an error in line 14 of /etc/audit/audit.rules -- System Information: Debian Release: 13.0 APT prefers stable-updates APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable') Architecture: arm64 (aarch64) Kernel: Linux 6.12.41+deb13-cloud-arm64 (SMP w/2 CPU threads) Locale: LANG=C.UTF-8, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE not set Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled Versions of packages auditd depends on: ii init-system-helpers 1.68 ii libaudit1 1:4.0.2-2+b2 ii libauparse0t64 1:4.0.2-2+b2 ii libc6 2.41-12 ii libcap-ng0 0.8.5-4+b1 ii libgssapi-krb5-2 1.21.3-5 ii libkrb5-3 1.21.3-5 ii libwrap0 7.6.q-36 ii mawk 1.3.4.20250131-1 auditd recommends no packages. Versions of packages auditd suggests: pn audispd-plugins <none> -- Configuration Files: /etc/audit/audisp-filter.conf [Errno 13] Permission denied: '/etc/audit/audisp-filter.conf' /etc/audit/audit-stop.rules [Errno 13] Permission denied: '/etc/audit/audit-stop.rules' /etc/audit/auditd.conf [Errno 13] Permission denied: '/etc/audit/auditd.conf' /etc/audit/plugins.d/af_unix.conf [Errno 13] Permission denied: '/etc/audit/plugins.d/af_unix.conf' /etc/audit/plugins.d/filter.conf [Errno 13] Permission denied: '/etc/audit/plugins.d/filter.conf' /etc/audit/plugins.d/syslog.conf [Errno 13] Permission denied: '/etc/audit/plugins.d/syslog.conf' /etc/audit/rules.d/audit.rules [Errno 13] Permission denied: '/etc/audit/rules.d/audit.rules' -- no debconf information
