Bug 2070705
| Summary: | Default systemd service config blocks audit watch rules in some directories | |||
|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Sergio Correia <scorreia> | |
| Component: | audit | Assignee: | Sergio Correia <scorreia> | |
| Status: | CLOSED ERRATA | QA Contact: | Martin Zelený <mzeleny> | |
| Severity: | high | Docs Contact: | ||
| Priority: | unspecified | |||
| Version: | 8.6 | CC: | lvrabec, mzeleny, pvlasin, sgrubb, tscherf | |
| Target Milestone: | rc | Keywords: | Regression, Triaged | |
| Target Release: | --- | Flags: | pm-rhel:
mirror+
|
|
| Hardware: | Unspecified | |||
| OS: | Unspecified | |||
| Whiteboard: | ||||
| Fixed In Version: | audit-3.0.7-2.el8.2 | Doc Type: | No Doc Update | |
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 2070706 2071727 (view as bug list) | Environment: | ||
| Last Closed: | 2022-05-10 15:30:12 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | ||||
| Bug Blocks: | 2070706, 2071727 | |||
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (audit bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2022:2096 |
Description of problem: With the default audit configuration, watch rules in some directories are blocked. This issue was reported upstream here [1] and fixed here [2]. Current auditd systemd service has a "ProtectHome=true" directive, which, as per systemd.exec(5) man page, "If true, the directories /home/, /root, and /run/user are made inaccessible and empty for processes invoked by this unit." As Paul explains in [1], "What is happening is that when you load an audit rule to watch a file like you are doing here, the kernel leverages some internal functionality to "tag" the file so that the audit subsystem is notified when it is accessed. With the systemd config above the "/home" and "/root" directories are not the same between when the audit rules are loaded and when the system is available for interactive use." Version-Release number of selected component (if applicable): audit-3.0.7-3.el8 How reproducible: always Steps to Reproduce: 1. Create a /etc/audit/rules.d/extra.rules file with the following content: -w /root/testfile -p rwxa -k test-root -w /home/testfile -p rwxa -k test-home 2. Restart the audit daemon: # service auditd restart 3. Write to both files: # start=$(date "+%T") # echo 1 > /root/testfile # echo 2 > /home/testfile # end=$(date "+%T") 4. Use ausearch to search for the test keys: # ausearch -ts ${start} -te ${end} -k test-root --format text # ausearch -ts ${start} -te ${end} -k test-home --format text Actual results: # ausearch -ts ${start} -te ${end} -k test-root --format text <no matches> # ausearch -ts ${start} -te ${end} -k test-home --format text <no matches> Expected results: # ausearch -ts ${start} -te ${end} -k test-root --format text At 13:22:58 03/31/2022 root successfully opened-file /root/testfile using bash # ausearch -ts ${start} -te ${end} -k test-home --format text At 13:23:01 03/31/2022 root successfully opened-file /home/testfile using bash Additional info: This change was introduced in 3.0.3 [3]. [1] https://github.com/linux-audit/audit-userspace/issues/256 [2] https://github.com/linux-audit/audit-userspace/commit/12cf14eda9fadeb7337a44653a80a57456afbb34 [3] https://github.com/linux-audit/audit-userspace/commit/3fcaa9