1000-1099 is for configuring things. So auditd ignored such messages. This is about actually logging what was configured. Move it into the range for such types of messages.
Showing the changes to include/uapi/linux (1 of 1 file). Show all
Unified · Split
| @@ -70,7 +70,6 @@ · 69 unmodified lines | |||
| 70 | #define AUDIT_TTY_SET 1017 /* Set TTY auditing status */ | 70 | #define AUDIT_TTY_SET 1017 /* Set TTY auditing status */ |
| 71 | #define AUDIT_SET_FEATURE 1018 /* Turn an audit feature on or off */ | 71 | #define AUDIT_SET_FEATURE 1018 /* Turn an audit feature on or off */ |
| 72 | #define AUDIT_GET_FEATURE 1019 /* Get which features are enabled */ | 72 | #define AUDIT_GET_FEATURE 1019 /* Get which features are enabled */ |
| 73 | #define AUDIT_FEATURE_CHANGE 1020 /* audit log listing feature changes */ | ||
| 74 | 73 | ||
| 75 | #define AUDIT_FIRST_USER_MSG 1100 /* Userspace messages mostly uninteresting to kernel */ | 74 | #define AUDIT_FIRST_USER_MSG 1100 /* Userspace messages mostly uninteresting to kernel */ |
| 76 | #define AUDIT_USER_AVC 1107 /* We filter this differently */ | 75 | #define AUDIT_USER_AVC 1107 /* We filter this differently */ |
| @@ -110,6 +109,7 @@ · 33 unmodified lines | |||
| 110 | #define AUDIT_NETFILTER_CFG 1325 /* Netfilter chain modifications */ | 109 | #define AUDIT_NETFILTER_CFG 1325 /* Netfilter chain modifications */ |
| 111 | #define AUDIT_SECCOMP 1326 /* Secure Computing event */ | 110 | #define AUDIT_SECCOMP 1326 /* Secure Computing event */ |
| 112 | #define AUDIT_PROCTITLE 1327 /* Proctitle emit event */ | 111 | #define AUDIT_PROCTITLE 1327 /* Proctitle emit event */ |
| 112 | #define AUDIT_FEATURE_CHANGE 1328 /* audit log listing feature changes */ | ||
| 113 | 113 | ||
| 114 | #define AUDIT_AVC 1400 /* SE Linux avc denial or grant */ | 114 | #define AUDIT_AVC 1400 /* SE Linux avc denial or grant */ |
| 115 | #define AUDIT_SELINUX_ERR 1401 /* Internal SE Linux Errors */ | 115 | #define AUDIT_SELINUX_ERR 1401 /* Internal SE Linux Errors */ |