From # prompt, I did this and got the below messages:
auditctl -w /etc/auditd.conf -p wa
permission option no longer supported
error sending add rule request (invalid argument)
auditctl -w /etc/auditd.conf
error sending add rule request (invalid argument)
It won't let me add rules. The capp.rules file I found is full of the above commands for various security relevant files. Each line with -w or -p says invlaid argument when I restart AUDITD.
I restored the original audit.rules file 9whcih I saved) and did the above - No change.
audit.rules has these lines by default:
-D
-b 256
that's it.
|