On Aug 6, 2025 Richard Guy Briggs <rgb@xxxxxxxxxx> wrote: > > When no audit rules are in place, fanotify event results are > unconditionally dropped due to an explicit check for the existence of > any audit rules. Given this is a report from another security > sub-system, allow it to be recorded regardless of the existence of any > audit rules. > > To test, install and run the fapolicyd daemon with default config. Then > as an unprivileged user, create and run a very simple binary that should > be denied. Then check for an event with > ausearch -m FANOTIFY -ts recent > > Link: https://issues.redhat.com/browse/RHEL-9065 > Signed-off-by: Richard Guy Briggs <rgb@xxxxxxxxxx> > --- > changelog: > v2 > - re-add audit_enabled check > --- > include/linux/audit.h | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) Merged into audit/dev-staging with the plan being to merge it to audit/dev once the merge window closes. -- paul-moore.com
