`audit_rules_privileged_commands` failing in Image Builder about content

[jan-cerny]

Hi @comps

From the verbose output it looks like the errors are there because neither object_priv_cmds_from_auditctl nor object_priv_cmds_from_augenrules matched anything. So I'd suggest first checking the contents of the /etc/audit/audit.rules and /etc/audit/rules.d whether there are really any lines matching the regexes defined in these objects.

It's always better to attach ARF to the tickets instead of verbose output and old report because verbose outputs and old reports aren't useful in complex cases.

I'm confused by the remark about the var_audit_rules_privileged_commands_priv_cmds_count variable because you copied its definition here and then you write that you can't find its definition. Can you reword this?