Bug 177638

Summary:	auditing is enabled by default
Product:	[Fedora] Fedora	Reporter:	David Woodhouse <dwmw2>
Component:	audit	Assignee:	Steve Grubb <sgrubb>
Status:	CLOSED RAWHIDE	QA Contact:	Brian Brock <bbrock>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	rawhide	CC:	notting
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2006-01-12 19:15:23 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description David Woodhouse 2006-01-12 16:35:49 UTC

In a fresh FC5t2 install, system call auditing got enabled by default, which is
going to massively reduce system performance. We really shouldn't do this.

Comment 1 Bill Nottingham 2006-01-12 16:38:11 UTC

You mean a) the audit daemon b) the kernel config option c) something else?

Comment 2 David Woodhouse 2006-01-12 16:53:42 UTC

The init script for the audit dÃ¦mon, which is installed and runs by default,
enables syscall auditing. It's like running every process on the system under
ptrace.

Comment 3 Bill Nottingham 2006-01-12 16:58:55 UTC

Assinging to package maintainer to turn it off by default.

Comment 4 Steve Grubb 2006-01-12 17:55:39 UTC

Bill, the audit package was not supposed to be selected by default. Its an
optional package that someone should pick to be installed. I think this was the
arrangement that we made for RHEL4.

Regarding the init script, I have a patch in the package to turn off audit by
default, but we are still in test mode. When we get closer to a real release,
I'll turn it off. There have been kernel bugs found recently by having it on.

Comment 5 Bill Nottingham 2006-01-12 19:15:23 UTC

Moved in comps from a 'default on' package in the Core group to an optional
package in the 'System Tools' group. Note, this may not make test2.