Bug 1966454

Summary:	BUG: the kernel does not initialize audit before forking PID 1
Product:	Red Hat Enterprise Linux 9	Reporter:	Ondrej Moriš <omoris>
Component:	kernel	Assignee:	Richard Guy Briggs <rbriggs>
kernel sub component:	Audit	QA Contact:	Ondrej Moriš <omoris>
Status:	CLOSED WONTFIX	Docs Contact:
Severity:	medium
Priority:	medium	CC:	omoris, pmoore, rbriggs, sgrubb, skozina, xiawu
Version:	9.0	Keywords:	Triaged
Target Milestone:	beta	Flags:	pm-rhel: mirror+
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:	1487352	Environment:
Last Closed:	2022-12-01 07:27:48 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1487352
Bug Blocks:	1476406

Description Ondrej Moriš 2021-06-01 08:27:05 UTC

I am following test procedure from BZ#1487352#c8 with 5.13.0-0.rc2.19.el9 and I see no MAC_STATUS audit records generated after boot when booted with audit=1.

Is it a regression or was audit initialization moved intentionally?

+++ This bug was initially created as a clone of Bug #1487352 +++

Description of problem:

Taken from the upstream GitHub issue:

 "The kernel needs to initialize the audit subsystem before forking init/systemd
  so that the audit subsystem can allocate an audit_context for the process, 
  enabling the collection of audit data if configured (e.g. audit=1 on the kernel 
  command line).

  The current audit code is initialized via the generic kernel initcall 
  mechanism, which is eventually called after the kernel forks PID 1 (PID 1 -> 
  kernel_init(...) -> kernel_init_freeable(...) -> do_basic_setup(...) -> 
  do_initcalls(...)). We most likely want to add a call to audit_init(...) before 
  key_init(...) or security_init(...) in start_kernel(...)."

Additional info:

Upstream GitHub issue:

* https://github.com/linux-audit/audit-kernel/issues/66

Comment 5 RHEL Program Management 2022-12-01 07:27:48 UTC

After evaluating this issue, there are no plans to address it further or fix it in an upcoming release.  Therefore, it is being closed.  If plans change such that this issue will be fixed in an upcoming release, then the bug can be reopened.