Bug 476798

Summary:	"auditd -n" does not work
Product:	[Fedora] Fedora	Reporter:	Harald Hoyer <harald>
Component:	audit	Assignee:	Steve Grubb <sgrubb>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	low
Version:	10	CC:	sgrubb
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2009-07-26 13:48:04 EDT	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Description Harald Hoyer 2008-12-17 02:35:41 EST

Starting auditd from upstart/inittab with "/sbin/auditd -n" does not work.
auditd bails out, complaining, that it is not allowed to fork :)

Comment 1 Harald Hoyer 2008-12-17 02:38:06 EST

/var/log/messages:

Cannot daemonize (Operation not permitted)

Comment 2 Steve Grubb 2008-12-17 07:02:11 EST

I believe this is because /dev/null may not exist yet. So, I instrumented the audit daemon to output a little more info about why it cannot daemonize. Please give the package here a try:

http://people.redhat.com/sgrubb/files/audit-1.7.11-1.src.rpm

Let me know what you find in syslog.

Comment 3 Harald Hoyer 2008-12-17 08:36:46 EST

(In reply to comment #2)
> I believe this is because /dev/null may not exist yet. 

hmm, no, this was tried from upstart and tried from shell.

> So, I instrumented the
> audit daemon to output a little more info about why it cannot daemonize. Please
> give the package here a try:
> 
> http://people.redhat.com/sgrubb/files/audit-1.7.11-1.src.rpm
> 
> Let me know what you find in syslog.

Dec 17 14:36:08 harryh kernel: audit(1229520968.001:239): audit_pid=0 old=495 auid=500 ses=1 subj=unconfined_u:system_r:auditd_t:s0 res=1
Dec 17 14:36:11 harryh auditd: Cannot changed session id
Dec 17 14:36:11 harryh auditd: Cannot daemonize (Operation not permitted)
Dec 17 14:36:11 harryh auditd: The audit daemon is exiting.

Comment 4 Steve Grubb 2008-12-17 09:12:11 EST

OK, that shows me what the problem is. It fails setsid() due to already being a session leader. I'll patch up the audit daemon and push it through the build system.

Comment 5 Steve Grubb 2008-12-17 10:19:10 EST

new audit packages can be found here:

http://koji.fedoraproject.org/koji/buildinfo?buildID=75101

Thanks for reporting the problem.

Comment 6 Harald Hoyer 2008-12-17 10:23:54 EST

Thanks! That was quick :)

Comment 7 Steve Grubb 2009-07-26 13:48:04 EDT

Closing out since bug appears to be fixed long ago.