On Thu, Aug 7, 2025 at 10:04 AM Richard Guy Briggs <rgb@xxxxxxxxxx> wrote: > On 2025-08-06 21:47, Paul Moore wrote: > > On Aug 6, 2025 Richard Guy Briggs <rgb@xxxxxxxxxx> wrote: > > > > > > When no audit rules are in place, fanotify event results are > > > unconditionally dropped due to an explicit check for the existence of > > > any audit rules. Given this is a report from another security > > > sub-system, allow it to be recorded regardless of the existence of any > > > audit rules. > > > > > > To test, install and run the fapolicyd daemon with default config. Then > > > as an unprivileged user, create and run a very simple binary that should > > > be denied. Then check for an event with > > > ausearch -m FANOTIFY -ts recent > > > > > > Link: https://issues.redhat.com/browse/RHEL-9065 > > > Signed-off-by: Richard Guy Briggs <rgb@xxxxxxxxxx> > > > --- > > > changelog: > > > v2 > > > - re-add audit_enabled check > > > --- > > > include/linux/audit.h | 2 +- > > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > Merged into audit/dev-staging with the plan being to merge it to > > audit/dev once the merge window closes. > > Thanks Paul. Now merged into audit/dev, thanks! -- paul-moore.com
