Bug 2182665

This bug was initially created as a copy of Bug #2182660

I am copying this bug because: 

Also applies to RHEL8.

Description of problem:

I know it's a known "limitation" of audit subsystem, but it's clear annoying and make us (Support) lose a lot of time regularly.

On a vanilla system not having any audit rule (the default), it happens that audit events are not always recorded.
This makes troubleshooting harder because we lose critical and valuable information.

For example this affected me recently when troubleshooting BZ #2181539.

But there are more scenarios where this happens, e.g. below:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
[root@vm-rhel9 ~]# cat /proc/sys/fs/protected_regular
1
[root@vm-rhel9 ~]# mkdir -p /root/tmp
[root@vm-rhel9 ~]# chmod 1777 /root/tmp
[root@vm-rhel9 ~]# touch /root/tmp/test.txt
[root@vm-rhel9 ~]# useradd test
[root@vm-rhel9 ~]# chown test /root/tmp/test.txt
[root@vm-rhel9 ~]# { echo C0644 12 test.txt ; printf 'hello\ntest1\n'; printf \\000; } | scp -t /root/tmp
scp: /root/tmp/test.txt: Permission denied
scp: protocol error: expected control record
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

Checking the audit log, we see nothing explaining the EACCES *scp* gets.

After adding an audit rule (related or not), and retrying the test, we can then see the reason:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
type=PROCTITLE msg=audit(03/29/2023 11:22:52.311:501) : proctitle=scp -t /root/tmp 
type=PATH msg=audit(03/29/2023 11:22:52.311:501) : item=1 name=/root/tmp/test.txt inode=33576200 dev=fd:00 mode=file,644 ouid=admin ogid=root rdev=00:00 obj=unconfined_u:object_r:admin_home_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=PATH msg=audit(03/29/2023 11:22:52.311:501) : item=0 name=/root/tmp/ inode=33576201 dev=fd:00 mode=dir,sticky,777 ouid=root ogid=root rdev=00:00 obj=unconfined_u:object_r:admin_home_t:s0 nametype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(03/29/2023 11:22:52.311:501) : cwd=/root 
type=SYSCALL msg=audit(03/29/2023 11:22:52.311:501) : arch=x86_64 syscall=openat success=no exit=EACCES(Permission denied) a0=AT_FDCWD a1=0x5629b4009500 a2=O_WRONLY|O_CREAT a3=0x1a4 items=2 ppid=12525 pid=12528 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts0 ses=6 comm=scp exe=/usr/bin/scp subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) 
type=ANOM_CREAT msg=audit(03/29/2023 11:22:52.311:501) : op=sticky_create_regular ppid=12525 pid=12528 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts0 ses=6 comm=scp exe=/usr/bin/scp subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 res=no 
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

Clearly something has to be done here, it's very often we lose a lot of time due to this limitation.
If nothing can be done, then we at least need to always ship a rule (e.g. the usual one on "/etc/shadow") with default configuration to avoid this pitfall in the future.

Version-Release number of selected component (if applicable):

audit-3.0.7-103.el9.x86_64

How reproducible:

Always, see above.