Bug 1350425

Summary: [TestOnly] update setroubleshoot to be able to work with re-based audit package
Product: Red Hat Enterprise Linux 7 Reporter: Petr Lautrbach <plautrba>
Component: setroubleshootAssignee: Petr Lautrbach <plautrba>
Status: CLOSED ERRATA QA Contact: Milos Malik <mmalik>
Severity: medium Docs Contact:
Priority: high    
Version: 7.2CC: bressers, ksrot, lmiksik, lvrabec, mgrepl, mjahoda, mmalik, mvollmer, omoris, plautrba, rsawhill, sgrubb
Target Milestone: rcKeywords: TestOnly
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: 1296204 Environment:
Last Closed: 2016-11-04 02:57:37 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Comment 1 Steve Grubb 2016-06-28 22:14:15 UTC
Before you get too far, there is a format bug in audispd. (Some newlines got deleted during copy and paste.) I need to update Fedora as well.

Comment 2 Marius Vollmer 2016-07-05 10:42:48 UTC
> Before you get too far, there is a format bug in audispd. (Some newlines got deleted during copy and paste.) I need to update Fedora as well.

Is this tracked somewhere?

Comment 3 Steve Grubb 2016-07-05 15:23:28 UTC
Not really. I found the bug and fixed it before QE did and respun the package. Its covered under the audit rebase bz.

Comment 7 Marius Vollmer 2016-07-08 12:04:51 UTC
I don't know what this bug is about, but please check bug 1353911.

Our recent setroubleshoot troubles were not caused by missing newlines and are not fixed by audit 2.6.3, as far as I can see.

I think audit 2.6.2 and later are internally inconsistent: auparse rejects what audispd writes.

Comment 8 Petr Lautrbach 2016-07-12 07:04:13 UTC
Most likely there's no need to change anything in setroubleshoot. There are issue in audit which sends malformed events with "msg=type=AVC" field to dispatcher as it's described in #1353911.

I'd like to let this bug open to verify if it's really fixed by audit update.

Comment 10 Karel Srot 2016-09-05 07:17:53 UTC
This bug in ON_QA bug missing in the errata. Please fix it.

Comment 19 errata-xmlrpc 2016-11-04 02:57:37 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-2298.html