Bug 1437426
| Summary: | Remove "--backlog_wait_time" from auditctl man page & rules | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Nilesh Parmar <nparmar> |
| Component: | audit | Assignee: | Steve Grubb <sgrubb> |
| Status: | CLOSED ERRATA | QA Contact: | Ondrej Moriš <omoris> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 7.3 | CC: | omoris, qe-baseos-security |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | audit-2.7.5-1.el7 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2017-08-01 20:53:38 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
audit-2.7.5-1.el7 was built to resolve this issue. Successfully verified manually.
OLD (audit-2.6.5-3.el7)
=======================
# man auditctl | grep -A 5 '\-b'
-b backlog
Set max number of outstanding audit buffers allowed (Kernel Default=64) If all buffers are full, the
failure flag is consulted by the kernel for action.
--backlog_wait_time wait_time
Set the time for the kernel to wait (Kernel Default 60*HZ) when the backlog_limit is reached before
queuing more audit events to be transferred to auditd. The number must be greater than or equal to
zero and less that 10 times the default value.
# auditctl --backlog_wait_time 0; echo $?
usage: auditctl [options]
-a <l,a> Append rule to end of <l>ist with <a>ction
-A <l,a> Add rule at beginning of <l>ist with <a>ction
-b <backlog> Set max number of outstanding audit buffers
allowed Default=64
-c Continue through errors in rules
-C f=f Compare collected fields if available:
Field name, operator(=,!=), field name
-d <l,a> Delete rule from <l>ist with <a>ction
l=task,exit,user,exclude
a=never,always
-D Delete all rules and watches
-e [0..2] Set enabled flag
-f [0..2] Set failure flag
0=silent 1=printk 2=panic
-F f=v Build rule: field name, operator(=,!=,<,>,<=,
>=,&,&=) value
-h Help
-i Ignore errors when reading rules from file
-k <key> Set filter key on audit rule
-l List rules
-m text Send a user-space message
-p [r|w|x|a] Set permissions filter on watch
r=read, w=write, x=execute, a=attribute
-q <mount,subtree> make subtree part of mount point's dir watches
-r <rate> Set limit in messages/sec (0=none)
-R <file> read rules from file
-s Report status
-S syscall Build rule: syscall name or number
-t Trim directory watches
-v Version
-w <path> Insert watch at <path>
-W <path> Remove watch at <path>
--loginuid-immutable Make loginuids unchangeable once set
255
# grep '\--backlog_wait_time' /etc/audit/* /usr/share/doc/audit-* -R
/usr/share/doc/audit-2.6.5/rules/10-base-config.rules:--backlog_wait_time 0
NEW (audit-2.7.6-1.el7)
=======================
# man auditctl | grep '\-b' -A 5
-b backlog
Set max number of outstanding audit buffers allowed (Kernel Default=64) If all buffers are full, the
failure flag is consulted by the kernel for action.
# auditctl --backlog_wait_time 0; echo $?
usage: auditctl [options]
-a <l,a> Append rule to end of <l>ist with <a>ction
-A <l,a> Add rule at beginning of <l>ist with <a>ction
-b <backlog> Set max number of outstanding audit buffers
allowed Default=64
-c Continue through errors in rules
-C f=f Compare collected fields if available:
Field name, operator(=,!=), field name
-d <l,a> Delete rule from <l>ist with <a>ction
l=task,exit,user,exclude
a=never,always
-D Delete all rules and watches
-e [0..2] Set enabled flag
-f [0..2] Set failure flag
0=silent 1=printk 2=panic
-F f=v Build rule: field name, operator(=,!=,<,>,<=,
>=,&,&=) value
-h Help
-i Ignore errors when reading rules from file
-k <key> Set filter key on audit rule
-l List rules
-m text Send a user-space message
-p [r|w|x|a] Set permissions filter on watch
r=read, w=write, x=execute, a=attribute
-q <mount,subtree> make subtree part of mount point's dir watches
-r <rate> Set limit in messages/sec (0=none)
-R <file> read rules from file
-s Report status
-S syscall Build rule: syscall name or number
-t Trim directory watches
-v Version
-w <path> Insert watch at <path>
-W <path> Remove watch at <path>
--loginuid-immutable Make loginuids unchangeable once set
--reset-lost Reset the lost record counter
255
# grep '\--backlog_wait_time' /etc/audit/* /usr/share/doc/audit-* -R
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2017:2008 |
Description of problem: Remove "--backlog_wait_time" option which is not supported with auditd yet Version-Release number of selected component (if applicable): audit-2.6.5-3.el7 How reproducible: Always Steps to Reproduce: 1] Install stock RHEL-7.3 machine 2] [root@dhcp8-128 ~]# auditctl --backlog_wait_time 0 usage: auditctl [options] -a <l,a> Append rule to end of <l>ist with <a>ction -A <l,a> Add rule at beginning of <l>ist with <a>ction -b <backlog> Set max number of outstanding audit buffers [...] Actual results: "--backlog_wait_time" option is included in "/usr/share/doc/audit-2.6.5/rules/10-base-config.rules" file & auditctl man page Expected results: Remove "--backlog_wait_time" option from "/usr/share/doc/audit-2.6.5/rules/10-base-config.rules" file & auditctl man page Additional info: