Bug 121660

Summary: LTC7787-LAuS: /etc/init.d/audit expect a file named /sbin/auditd64 on PPC64 arch, but no such file shipped in rhel 3 U2 Beta
Product: Red Hat Enterprise Linux 3 Reporter: IBM Bug Proxy <bugproxy>
Component: lausAssignee: Charlie Bennett <ccb>
Status: CLOSED CURRENTRELEASE QA Contact: Jay Turner <jturner>
Severity: medium Docs Contact:
Priority: medium    
Version: 3.0CC: srevivo
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: RHEL3, U3 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2004-09-07 15:32:07 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description IBM Bug Proxy 2004-04-24 21:28:33 UTC
The following has be reported by IBM LTC:  
LAuS: /etc/init.d/audit expect a file named /sbin/auditd64 on PPC64
arch, but no such file shipped in RHEL3 U2 Beta
Hardware Environment:
    P630

Software Environment:
    03/30 released RHEL3 U2 Beta, with the kernel updated to 2.4.21-13.EL
    LAuS package laud-0.1-48RHEL3(Linux Audit Subsystem), which was
added into 
RHEL at Update2 Beta(03/30)

Steps to Reproduce:
1. use /etc/init.d/audit to start LAuS daemon, but no daemon created
[root@plinuxt2 root]# /etc/init.d/audit start
[root@plinuxt2 root]# ps -ef|grep audit
root      8319  6616  0 13:55 pts/15   00:00:00 grep audit
[root@plinuxt2 root]# 

2. enable -x option to this start script, and find that it need
/sbin/auditd64 
to work, but there is no /sbin/auditd64 shipped in RHEL3 U2 beta on
PPC64 arch
 
[root@plinuxt2 root]# sh -x /etc/init.d/audit start
+ test -s /etc/sysconfig/audit
+ initdir=/etc/init.d
+ . /etc/init.d/functions
......
++ arch
+ '[' ppc64 = ppc64 ']'
+ AUDITD_BIN=/sbin/auditd64
+ test -x /sbin/auditd64
+ exit 5

3.

Actual Results:
    /etc/init.d/audit could start audit daemon

Expected Results:

Additional Information:
   Following is the content of laus package shipped in RHEL3 U2 Beta.
It seems 
that there are two set of files: one for 32bits and one for 64bits,
but the 
64bits files overwrite the 32bits ones:
================ The detailed information of laus package
==================
[root@plinuxt2 root]# rpm -qil laus
Name        : laus                         Relocations: (not relocatable)
Version     : 0.1                               Vendor: Red Hat, Inc.
Release     : 48RHEL3                       Build Date: Tue 09 Mar 2004 
11:09:34 PM CST
Install Date: Wed 07 Apr 2004 03:47:48 PM CST      Build Host: 
cure81.devel.redhat.com
Group       : System/Monitoring             Source RPM:
laus-0.1-48RHEL3.src.rpm
Size        : 287285                           License: GPL
Signature   : DSA/SHA1, Thu 11 Mar 2004 03:13:00 AM CST, Key ID
fd372689897da07a
Packager    : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla>
Summary     : Linux Audit-Subsystem user space tools and daemon
Description :
This package includes all user space utilities needed for handling the
Linux 
Audit-Subsystem (LAuS).
The following components are included:
- audit daemon
- audit tools
- PAM module
- liblaus
- liblaussrv
- man pages

Your kernel has to support system call auditing to make these tools work.

Authors:
--------
    Olaf Kirch <okir>
    Thomas Biege <thomas>
/etc/audit
/etc/audit/audit.conf
/etc/audit/filesets.conf
/etc/audit/filter.conf
/etc/init.d/audit
/lib/security/pam_laus.so
/sbin/auditd
/usr/lib/liblaus.so.1
/usr/lib/liblaus.so.1.0.0
/usr/lib/liblaussrv.so.0
/usr/lib/liblaussrv.so.0.0.0
/usr/sbin/aucat
/usr/sbin/audbin
/usr/sbin/augrep
/usr/sbin/aurun
/usr/share/doc/laus-0.1
/usr/share/doc/laus-0.1/AUTHORS
/usr/share/doc/laus-0.1/COPYING
/usr/share/doc/laus-0.1/ChangeLog
/usr/share/doc/laus-0.1/INSTALL
/usr/share/doc/laus-0.1/NEWS
/usr/share/doc/laus-0.1/README
/usr/share/doc/laus-0.1/TODO
/usr/share/man/man1/aucat.1.gz
/usr/share/man/man1/audbin.1.gz
/usr/share/man/man1/augrep.1.gz
/usr/share/man/man4/audit.4.gz
/usr/share/man/man5/audit-filesets.conf.5.gz
/usr/share/man/man5/audit-filter.conf.5.gz
/usr/share/man/man5/audit.conf.5.gz
/usr/share/man/man7/laus-fields.7.gz
/usr/share/man/man7/laus-record.7.gz
/usr/share/man/man7/laus.7.gz
/usr/share/man/man8/auditd.8.gz
/usr/share/man/man8/aurun.8.gz
Name        : laus                         Relocations: (not relocatable)
Version     : 0.1                               Vendor: Red Hat, Inc.
Release     : 48RHEL3                       Build Date: Tue 09 Mar 2004 
11:10:18 PM CST
Install Date: Wed 07 Apr 2004 03:47:49 PM CST      Build Host: 
stagg.build.redhat.com
Group       : System/Monitoring             Source RPM:
laus-0.1-48RHEL3.src.rpm
Size        : 376101                           License: GPL
Signature   : DSA/SHA1, Thu 11 Mar 2004 03:12:59 AM CST, Key ID
fd372689897da07a
Packager    : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla>
Summary     : Linux Audit-Subsystem user space tools and daemon
Description :
This package includes all user space utilities needed for handling the
Linux 
Audit-Subsystem (LAuS).
The following components are included:
- audit daemon
- audit tools
- PAM module
- liblaus
- liblaussrv
- man pages

Your kernel has to support system call auditing to make these tools work.

Authors:
--------
    Olaf Kirch <okir>
    Thomas Biege <thomas>
/etc/audit
/etc/audit/audit.conf
/etc/audit/filesets.conf
/etc/audit/filter.conf
/etc/init.d/audit
/lib64/security/pam_laus.so
/sbin/auditd
/usr/lib64/liblaus.so.1
/usr/lib64/liblaus.so.1.0.0
/usr/lib64/liblaussrv.so.0
/usr/lib64/liblaussrv.so.0.0.0
/usr/sbin/aucat
/usr/sbin/audbin
/usr/sbin/augrep
/usr/sbin/aurun
/usr/share/doc/laus-0.1
/usr/share/doc/laus-0.1/AUTHORS
/usr/share/doc/laus-0.1/COPYING
/usr/share/doc/laus-0.1/ChangeLog
/usr/share/doc/laus-0.1/INSTALL
/usr/share/doc/laus-0.1/NEWS
/usr/share/doc/laus-0.1/README
/usr/share/doc/laus-0.1/TODO
/usr/share/man/man1/aucat.1.gz
/usr/share/man/man1/audbin.1.gz
/usr/share/man/man1/augrep.1.gz
/usr/share/man/man4/audit.4.gz
/usr/share/man/man5/audit-filesets.conf.5.gz
/usr/share/man/man5/audit-filter.conf.5.gz
/usr/share/man/man5/audit.conf.5.gz
/usr/share/man/man7/laus-fields.7.gz
/usr/share/man/man7/laus-record.7.gz
/usr/share/man/man7/laus.7.gz
/usr/share/man/man8/auditd.8.gz
/usr/share/man/man8/aurun.8.gzOne more finding:
[root@plinuxt2 root]# rpm -qa|grep laus
laus-devel-0.1-48RHEL3
laus-0.1-48RHEL3
laus-0.1-48RHEL3
   
what is the difference between the last two? Maybe the second one
should be 
named laus64, and the corresponding binary should renamed to
/sbin/auditd64. 
Just my guess. Thanks.

Comment 1 Bill Nottingham 2004-04-27 20:51:03 UTC
This should be fixed in 0.1-50RHEL3 and later. Please check.

Comment 2 IBM Bug Proxy 2004-04-28 01:17:37 UTC
----- Additional Comments From zhouwu.com  2004-04-27 21:20 -------
Could you tell me in which release will this new package be shipped? So I can 
check this once the release is available. Thanks. 

Comment 3 IBM Bug Proxy 2004-05-09 05:55:37 UTC
----- Additional Comments From zhouwu.com  2004-05-09 01:52 -------
Yes, this defect is fixed with the latest version:0.1-54RHEL3. We have just 
maken a verification on 05/05 release U2 RC. Thanks. 

Comment 4 James Laska 2004-07-09 12:41:20 UTC
We are still seeing this issue in U3 candidate trees.  The laus
version is laus-0.1-62RHEL3.  Duplicating the new bug reported by IBM
LTC...

Comment 5 James Laska 2004-07-09 12:41:30 UTC
*** Bug 126779 has been marked as a duplicate of this bug. ***

Comment 6 James Laska 2004-07-09 14:52:43 UTC
I see both a ppc and a ppc64 version of the laus rpm...however both
packages provide a /sbin/auditd.  And it appears that the 32b version
of /sbin/auditd attempts to execv /sbin/auditd64 which doesn't exist:

# file /sbin/auditd
/sbin/auditd: ELF 32-bit MSB executable, PowerPC or cisco 4500,
version 1 (SYSV), for GNU/Linux 2.2.5, dynamically linked (uses shared
libs), stripped

# strace /sbin/auditd

open("/lib/tls/libc.so.6", O_RDONLY)    = 3
read(3, "\177ELF\1\2\1\0\0\0\0\0\0\0\0\0\0\3\0\24\0\0\0\1\0\1\301"...,
512) = 512
fstat64(3, {st_mode=S_IFREG|0755, st_size=1605852, ...}) = 0
mmap(0xfe47000, 1399388, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) =
0xfe47000
mprotect(0xff86000, 92764, PROT_NONE)   = 0
mmap(0xff87000, 81920, PROT_READ|PROT_WRITE|PROT_EXEC,
MAP_PRIVATE|MAP_FIXED, 3, 0x130000) = 0xff87000
mmap(0xff9b000, 6748, PROT_READ|PROT_WRITE|PROT_EXEC,
MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xff9b000
close(3)                                = 0
munmap(0x40028000, 97594)               = 0
uname({sys="Linux", node="localhost.localdomain", ...}) = 0
brk(0)                                  = 0x1001d000
brk(0x1003e000)                         = 0x1003e000
brk(0)                                  = 0x1003e000
execve("/sbin/auditd64", ["/sbin/auditd64"], [/* 24 vars */]) = -1
ENOENT (No such file or directory)
dup(2)                                  = 3
fcntl64(3, F_GETFL)                     = 0x2 (flags O_RDWR)
fstat64(3, {st_mode=S_IFCHR|0620, st_rdev=makedev(229, 0), ...}) = 0
ioctl(3, TCGETS or TCGETS, {B38400 opost isig icanon echo ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1,
0) = 0x40028000
_llseek(3, 0, 0xffffa4b8, SEEK_CUR)     = -1 ESPIPE (Illegal seek)
write(3, "/sbin/auditd64: No such file or "..., 42/sbin/auditd64: No
such file or directory

It appears that installing the ppc64 version of laus
(laus-0.1-62RHEL3.ppc64.rpm) corrects the issue and auditd is able to
startup without error.  The current beta candidate tree contains only
the following laus packages.  Looking at the following package list,
it doesn't appear that the beta candidate trees solve the problem.

laus-0.1-62RHEL3.ppc.rpm         laus-libs-0.1-62RHEL3.ppc64.rpm
laus-devel-0.1-62RHEL3.ppc.rpm   laus-libs-0.1-62RHEL3.ppc.rpm

Thoughts?

Comment 7 Charlie Bennett 2004-07-09 15:54:52 UTC
There's not supposed to be a 32-bit auditd on ppc64.  Let me dig into
this and get it fixed.  32-bit laus-libs are provided only to keep the
32-bit PAM happy.

Comment 8 Charlie Bennett 2004-09-07 15:32:07 UTC
Fixed.