Auditd doesn't receive syscalls after installation for the current shell.

Hello there.

It seems that the kernel doesn't send messages for syscalls of the shell 
process from which auditd is installed.

Reproducing steps (performed on Ubuntu 22.04 x86_64 on virtual box by 
`root`):

step #1: $ apt install auditd
step #2: $ auditctl -a always,exit -F arch=b64 -S openat,renameat2,unlinkat
step #3: $ echo t>delme;echo t2>>delme;cat delme;mv delme d;mv d 
delme;rm delme
step #4: $ service auditd stop
step #5: $ ausearch -f delme

There are syscalls from /usr/bin/cat, /usr/bin/mv, /usr/bin/rm but there 
are no any syscalls (openat expected)
for /usr/bin/bash (current shell process) for the file.

If step #3 is performed from another tty, then openat syscalls
(CREATE for the first echo and NORMAL for the second one)
is logged for the /usr/bin/bash process.

`uname -a` returns: Linux grin-vb-ubuntu-22-0-4 5.19.0-41-generic 
#42~22.04.01-Ubuntu SMP PREEMPT_DYNAMIC Tue Apr 18 17:40:00 UTC 2 x86_64 
x86_64 x86_64 GNU/Linux

Should I open an issue for the case at 
https://github.com/linux-audit/audit-kernel ?


Best regards
Rinat


PS.
At first I had the same problem with my service that listens to 
audit-netlink.
Then I just checked out the same scenario for auditid.

--
Linux-audit mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/linux-audit