Bug 835599
| Summary: | can not use usernames for field rules (auditctl -F uid=...) | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Cristian Ciupitu <cristian.ciupitu> |
| Component: | audit | Assignee: | Steve Grubb <sgrubb> |
| Status: | CLOSED NEXTRELEASE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | low | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 18 | CC: | sgrubb |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2013-12-21 13:47:21 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Does superuser exist on that machine? Auditctl takes the name supplied and calls getpwnam. So, if its failing to convert the text, then something is wrong in the user name lookup. About the only thing that can go wrong is that the user account is missing. It works fine on my machine. [root@hermes ~]# id superuser uid=1002(superuser) gid=1002(superuser) groups=1002(superuser) [root@hermes ~]# auditctl -a exit,always -F arch=b64 -S lstat -F uid=superuser Unknown user: superuser -F unknown field: uid Is your user database in /etc/password or sssd or ldap or something else? I was using passwd i.e. /etc/nsswitch.conf looked like this:
passwd: files
shadow: files
group: files
This message is a reminder that Fedora 17 is nearing its end of life. Approximately 4 (four) weeks from now Fedora will stop maintaining and issuing updates for Fedora 17. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as WONTFIX if it remains open with a Fedora 'version' of '17'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, simply change the 'version' to a later Fedora version prior to Fedora 17's end of life. Bug Reporter: Thank you for reporting this issue and we are sorry that we may not be able to fix it before Fedora 17 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora, you are encouraged change the 'version' to a later Fedora version prior to Fedora 17's end of life. Although we aim to fix as many bugs as possible during every release's lifetime, sometimes those efforts are overtaken by events. Often a more recent Fedora release includes newer upstream software that fixes bugs or makes them obsolete. It's still happening in Fedora 18, audit-2.3.1-2.fc18.x86_64. This message is a reminder that Fedora 18 is nearing its end of life. Approximately 4 (four) weeks from now Fedora will stop maintaining and issuing updates for Fedora 18. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as WONTFIX if it remains open with a Fedora 'version' of '18'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, simply change the 'version' to a later Fedora version prior to Fedora 18's end of life. Thank you for reporting this issue and we are sorry that we may not be able to fix it before Fedora 18 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora, you are encouraged change the 'version' to a later Fedora version prior to Fedora 18's end of life. Although we aim to fix as many bugs as possible during every release's lifetime, sometimes those efforts are overtaken by events. Often a more recent Fedora release includes newer upstream software that fixes bugs or makes them obsolete. Seems to be fixed in audit-2.3.2-1.fc20.x86_64. |
Description of problem: The auditctl man page says the following about field rules: uid User ID. May be numeric or the user account name. yet, I can use the name, it works only with the number. Version-Release number of selected component (if applicable): audit-2.2.1-1.fc17.x86_64 How reproducible: Every time Steps to Reproduce: 1. auditctl -a exit,always -F arch=b64 -S lstat -F uid=superuser Actual results: Unknown user: superuser -F unknown field: uid Expected results: No error. Additional info: auditctl -a exit,always -F arch=b64 -S lstat -F uid=1002 # works fine