You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
augenrules --load "Rule exists" errors: CaC time-related audit rules (audit_rules_time_adjtimex, audit_rules_time_settimeofday, audit_rules_time_stime) all generate the same combined -a always,exit -F arch=... -S adjtimex -S settimeofday line. Each rule got its own fragment file, so augenrules would concatenate three copies of the same rule into audit.rules. The kernel rejects duplicates with "Rule exists", causing augenrules to exit non-zero, which fails audit-rules.service and cascades to auditd.service. The fix: emit_tree now globally deduplicates rule lines across all audit fragments before rendering. The first fragment in sort order (adjtimex) keeps the combined rule; settimeofday and stime fragments become empty and are omitted entirely.