Bug 853104

Well, AUDIT_SYSTEM_SHUTDOWN is not the only audit event we send. We'll also send events for all the services that are stopped. We probably should make sure auditd gets those too at shutdown? 

Here's what I propose: change auditd.service to include the followin in the [Unit] section:

DefaultDependencies=no
After=local-fs.target
Conflicts=shutdown.target
Before=sysinit.target shutdown.target

This will turn auditd into an early boot service that is mounted after all local FS are mounted but before all normal services are started. It also has the effect that it is terminated on shutdown after all normal services (this is because the shutdown order is always implicitly the reverse of the startup order in systemd).

This should give you the desired effect and you'd always collect the audit messages of all normal services startup/shutdown with auditd.

(Oh, and while you are at it: if you edit auditd.service, please drop the After=syslog.target line, it is unnecessary these days)

Reassigning to auditd.

Testing shows that this does not solve the problem either.

Since the recommendation in comment 2 did not resolve the issue, I am reassigning to systemd. We need this fixed for Common Criteria testing.

Fixed in systemd git.

http://cgit.freedesktop.org/systemd/systemd/commit/?id=3f92e4b4b61042391bd44de4dceb18177df0dd57

Has the fix been put into a released systemd rpm? I just tested an updated F19 system and aulast is still reporting that the system always crashes instead of shutting down.

Tested this on a new F19 system. Its not working.

# ausearch --start today -m SYSTEM_SHUTDOWN
<no matches>

Unit file looks like this:

[Unit]
Description=Security Auditing Service
DefaultDependencies=no
After=local-fs.target
Conflicts=shutdown.target
Before=sysinit.target shutdown.target
RefuseManualStop=yes

Has the above commit made it into Fedora? Has anyone on systemd team verified the fix? Thanks.

(In reply to Steve Grubb from comment #7)
> Has the above commit made it into Fedora? Has anyone on systemd team
> verified the fix? Thanks.

Will be in systemd-205

This message is a reminder that Fedora 18 is nearing its end of life.
Approximately 4 (four) weeks from now Fedora will stop maintaining
and issuing updates for Fedora 18. It is Fedora's policy to close all
bug reports from releases that are no longer maintained. At that time
this bug will be closed as WONTFIX if it remains open with a Fedora 
'version' of '18'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version prior to Fedora 18's end of life.

Thank you for reporting this issue and we are sorry that we may not be 
able to fix it before Fedora 18 is end of life. If you would still like 
to see this bug fixed and are able to reproduce it against a later version 
of Fedora, you are encouraged  change the 'version' to a later Fedora 
version prior to Fedora 18's end of life.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events. Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

Just checked this problem on F20 which uses systemd-208. Either it was never fixed or it regressed. When this was fixed, did anyone run aulast to see if it was fixed?

This seems like its working now in F20. Not sure if an update specifically fixed it. But I'll close it in any event.