Skip to content

v1.0.7

Choose a tag to compare

@doccaz doccaz released this 05 Jun 14:05
7e9da87

Changes in v1.0.7

Bug fixes

  • augenrules --load "Rule exists" errors: CaC time-related audit rules (audit_rules_time_adjtimex, audit_rules_time_settimeofday, audit_rules_time_stime) all generate the same combined -a always,exit -F arch=... -S adjtimex -S settimeofday line. Each rule got its own fragment file, so augenrules would concatenate three copies of the same rule into audit.rules. The kernel rejects duplicates with "Rule exists", causing augenrules to exit non-zero, which fails audit-rules.service and cascades to auditd.service. The fix: emit_tree now globally deduplicates rule lines across all audit fragments before rendering. The first fragment in sort order (adjtimex) keeps the combined rule; settimeofday and stime fragments become empty and are omitted entirely.