Hello Stefan, you are right - these were problems with our rules (one typo and also duplicate rules) which unfortunately was not visible with old kernel - 5.15.0-140 was loading this without any complaints.
Please close this request, sorry for wasting your time. And also thanks for fixing the bug 2126434 System hangs when loading audit rules (5.15.0-156.166). -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/2127055 Title: augenrules - unable to load auditd rules (5.15.0-156) Status in linux package in Ubuntu: New Status in linux source package in Jammy: Confirmed Bug description: == Impact == Ubuntu 22.04.5 LTS (Jammy Jellyfish) After upgrading from kernel 5.15.0-140 to 5.15.0-160 we have multiple issues with auditd rules. Not fixed in 5.15.0-160-generic #170 from proposed repositories. With large auditd.rules augenrules --load allways fail after parsing 135 lines of audit.d rules, no matter what rules we use: root@xxx:~# uname -a Linux xxx 5.15.0-160-generic #170-Ubuntu SMP Wed Oct 1 10:06:56 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux root@xxx:~# /sbin/augenrules --load /sbin/augenrules: No change No rules enabled 1 failure 1 pid 3348 rate_limit 0 backlog_limit 8192 lost 0 backlog 116 backlog_wait_time 60000 backlog_wait_time_actual 0 enabled 1 failure 1 pid 3348 rate_limit 0 backlog_limit 8192 lost 0 backlog 120 backlog_wait_time 60000 backlog_wait_time_actual 0 enabled 1 failure 1 pid 3348 rate_limit 0 backlog_limit 8192 lost 0 backlog 63 backlog_wait_time 60000 backlog_wait_time_actual 0 arch elf mapping not found There was an error in line 135 of /etc/audit/audit.rules == Testcase == Loading many auditd rules (150+, I can provide the .rules file to you for testing) with /sbin/augenrules --load does not work as expected. == Regression Potential == Anything related to netlink sockets: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2126434 ProblemType: Bug DistroRelease: Ubuntu 22.04 Package: linux-image-5.15.0-160-generic 5.15.0-160.170 ProcVersionSignature: Ubuntu 5.15.0-160.170-generic 5.15.189 Uname: Linux 5.15.0-160-generic x86_64 AlsaDevices: total 0 crw-rw---- 1 root audio 116, 1 Oct 8 08:39 seq crw-rw---- 1 root audio 116, 33 Oct 8 08:39 timer AplayDevices: Error: [Errno 2] No such file or directory: 'aplay' ApportVersion: 2.20.11-0ubuntu82.10 Architecture: amd64 ArecordDevices: Error: [Errno 2] No such file or directory: 'arecord' AudioDevicesInUse: Error: command ['fuser', '-v', '/dev/snd/seq', '/dev/snd/timer'] failed with exit code 1: CasperMD5CheckResult: unknown Date: Wed Oct 8 08:41:01 2025 IwConfig: Error: [Errno 2] No such file or directory: 'iwconfig' Lsusb: Error: command ['lsusb'] failed with exit code 1: Lsusb-t: Lsusb-v: Error: command ['lsusb', '-v'] failed with exit code 1: MachineType: VMware, Inc. VMware Virtual Platform PciMultimedia: ProcEnviron: TERM=xterm-256color PATH=(custom, no user) LANG=en_US.UTF-8 SHELL=/bin/bash ProcFB: 0 svgadrmfb ProcKernelCmdLine: BOOT_IMAGE=/vmlinuz-5.15.0-160-generic root=/dev/mapper/ubuntu-root ro ipv6.disable=1 audit=1 audit_backlog_limit=8192 ipv6.disable=1 maybe-ubiquity RelatedPackageVersions: linux-restricted-modules-5.15.0-160-generic N/A linux-backports-modules-5.15.0-160-generic N/A linux-firmware 20220329.git681281e4-0ubuntu3.39 RfKill: Error: [Errno 2] No such file or directory: 'rfkill' SourcePackage: linux UpgradeStatus: Upgraded to jammy on 2023-03-28 (925 days ago) dmi.bios.date: 11/12/2020 dmi.bios.release: 4.6 dmi.bios.vendor: Phoenix Technologies LTD dmi.bios.version: 6.00 dmi.board.name: 440BX Desktop Reference Platform dmi.board.vendor: Intel Corporation dmi.board.version: None dmi.chassis.asset.tag: No Asset Tag dmi.chassis.type: 1 dmi.chassis.vendor: No Enclosure dmi.chassis.version: N/A dmi.ec.firmware.release: 0.0 dmi.modalias: dmi:bvnPhoenixTechnologiesLTD:bvr6.00:bd11/12/2020:br4.6:efr0.0:svnVMware,Inc.:pnVMwareVirtualPlatform:pvrNone:rvnIntelCorporation:rn440BXDesktopReferencePlatform:rvrNone:cvnNoEnclosure:ct1:cvrN/A:sku: dmi.product.name: VMware Virtual Platform dmi.product.version: None dmi.sys.vendor: VMware, Inc. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2127055/+subscriptions -- Mailing list: https://launchpad.net/~kernel-packages Post to : [email protected] Unsubscribe : https://launchpad.net/~kernel-packages More help : https://help.launchpad.net/ListHelp
