Bug 520132

Summary: "Error sending signal_info request" when shutting down
Product: [Fedora] Fedora Reporter: Matt Castelein <matt.castelein>
Component: kernelAssignee: Eric Paris <eparis>
Status: CLOSED UPSTREAM QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: low Docs Contact:
Priority: low    
Version: rawhideCC: eparis, itamar, kernel-maint, sgrubb
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2009-10-13 16:01:39 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
strace of auditd none

Description Matt Castelein 2009-08-28 14:59:29 UTC
auditd complains about "Error sending signal_info request" when the system is shutting down or rebooting.

Aug 27 15:49:06 arturo usbhid-ups[1823]: Signal 15: exiting
Aug 27 15:49:06 arturo rpc.statd[1551]: Caught signal 15, un-registering and exiting.
Aug 27 15:49:07 arturo rpcbind: rpcbind terminating on signal. Restart with "rpcbind -w"
Aug 27 15:49:07 arturo auditd[1436]: Error sending signal_info request (Operation not supported)
Aug 27 15:49:07 arturo auditd[1436]: The audit daemon is exiting.

Comment 1 Matt Castelein 2009-08-28 15:00:27 UTC
Sorry, forgot to say I am using audit-1.7.13-1.fc11.x86_64

Comment 2 Steve Grubb 2009-08-28 15:24:12 UTC
Do you get that message when just restarting the audit daemon?
service auditd restart

Comment 3 Matt Castelein 2009-08-28 15:27:55 UTC
Yes, I do get the same message when restarting the daemon.

Comment 4 Steve Grubb 2009-08-28 15:53:20 UTC
Ok, that's good. It would be helpful get an strace of auditd shutting down. While its running, get the pid of the audit daemon. Then attach strace to it like this:

strace -p <pid> > strace.log 2>&1

Then in another terminal, service auditd stop. I'm not seeing it happen here. Also, what kernel are you running?

Comment 5 Matt Castelein 2009-08-28 16:28:07 UTC
Created attachment 359095 [details]
strace of auditd

Here is the strace.  I am running kernel 2.6.29.6-217.2.16.fc11.x86_64.

Comment 6 Eric Paris 2009-08-28 19:22:20 UTC
Do you have SELinux disabled?

Comment 7 Eric Paris 2009-08-28 19:23:29 UTC
Let me restate, did you rebuild your kernel without CONFIG_SECURITY.

Comment 8 Eric Paris 2009-08-28 19:31:35 UTC
reassigning to kernel and to me, I see the problem.

Comment 9 Matt Castelein 2009-08-28 19:35:32 UTC
I did not rebuild the kernel.  SELinux is in permissive mode.

Comment 10 Eric Paris 2009-08-28 19:35:55 UTC
case AUDIT_SIGNAL_INFO:
                err = security_secid_to_secctx(audit_sig_sid, &ctx, &len);
                if (err)
                        return err;


int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
{
        return security_ops->secid_to_secctx(secid, secdata, seclen);
}

static int cap_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
{
        return -EOPNOTSUPP;
}


Just need to check the return from security_secid_to_secctx() in the audit code and not bail on EOPNOTSUPP;

It should be 'relatively' harmless, you aren't getting all the logging you should, but that's the only problem.  I'll get it fixed up.

Comment 11 Matt Castelein 2009-08-28 19:39:25 UTC
Sorry, disabled, not permissive.