Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
For bugs related to Red Hat Enterprise Linux 5 product line. The current stable release is 5.10. For Red Hat Enterprise Linux 6 and above, please visit Red Hat JIRA https://issues.redhat.com/secure/CreateIssue!default.jspa?pid=12332745 to report new issues.

Bug 654883

Summary: service auditd restart output in immutable mode is not clear.
Product: Red Hat Enterprise Linux 5 Reporter: Raghu Udiyar <rudiyar>
Component: auditAssignee: Steve Grubb <sgrubb>
Status: CLOSED ERRATA QA Contact: Ondrej Moriš <omoris>
Severity: medium Docs Contact:
Priority: medium    
Version: 5.5CC: omoris
Target Milestone: rc   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: audit-1.8-1.el5 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-02-21 06:37:53 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Raghu Udiyar 2010-11-18 22:39:51 UTC 
Description of problem:

When auditd is in immutable mode and auditd service is restarted you get the message "The audit system is in immutable mode, no rules loaded." 

This is confusing. Since the original rules are loaded. Its' just that once they are loaded they can't be changed without a reboot.

Perhaps "The audit system is in immutable mode, no changes allowed" would be more clear.


Version-Release number of selected component (if applicable): audit-1.7.17-3.el5


How reproducible: Always


Steps to Reproduce:
1. Add "-e 2" to /etc/audit/audit.rules file.
2. Run "service auditd restart". This puts audit in immutable mode.
3. Any subsequent attempt to restart the service throws the message : "The audit system is in immutable mode, no rules loaded"
  
Actual results: The message is unclear and misleading.


Expected results: "no rules loaded" should be changed to something else.


Additional info:
Comment 1 Steve Grubb 2011-01-15 14:42:16 UTC 
Patch committed upstream.
Comment 2 Raghu Udiyar 2011-01-17 11:02:48 UTC 
Thank you.
Comment 4 Steve Grubb 2011-10-27 15:39:01 UTC 
audit-1.8-1.el5 was built to address this problem.
Comment 7 errata-xmlrpc 2012-02-21 06:37:53 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2012-0265.html