Description of problem: When listing audit rules, large inode values may not display properly. Version-Release number of selected component (if applicable): audit-1.7.17-3.el5 How reproducible: 100% Steps to Reproduce: # auditctl -a exit,always -S all -F inode=`ls -i /proc/cpuinfo \ | awk '{print $1}'` # auditctl -l Actual results: LIST_RULES: exit,always inode=-268435445 (0xf000000b) syscall=all Expected results: LIST_RULES: exit,always inode=4026531851 (0xf000000b) syscall=all Additional info: This is the "other bug" referenced in Bug 554553 :) Fixed upstream: https://fedorahosted.org/audit/changeset/392
Created attachment 426720 [details] Proposed patch Stolen from https://fedorahosted.org/audit/changeset/392
audit-1.7.18-1 was built to resolve this problem.
Technical note added. If any revisions are required, please edit the "Technical Notes" field accordingly. All revisions will be proofread by the Engineering Content Services team. New Contents: When an ignore directive was included in an audit.rules configuration file, the auditctl utility became unresponsive when attempting to load those rules. With this update, the issue is resolved.
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on therefore solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHBA-2011-0083.html