Red Hat Bugzilla – Bug 1118262
Audit daemon will not change group ownership from configuration file after SIGHUP
Last modified: 2016-11-04 02:11:05 EDT
Description of problem: If I change log_group parameter in /etc/audit/auditd.conf, according to manpage I should send SIGHUP signal to auditd process. But group owner is not changed after this call. Other paramaters like log_file are changed correctly. Only way how can I use new configuration is call 'service auditd restart', but this is not possible on el7. Version-Release number of selected component (if applicable): Name : audit Arch : x86_64 Version : 2.2 Release : 2.el6 Size : 956 k Repo : installed From repo : sl6 How reproducible: Steps to Reproduce: 1. change log_group in conf file 2. 'killall -s SIGHUP auditd' 3. check log file group owner Actual results: Expected results: Additional info:
Created attachment 917052 [details] Suggested fix
I am not sure this is an audit bug or something that needs better documentation. When you change the group owner, presumably you need to chgrp -R /var/log/audit. Changing the current file does nothing to solve the rest. I have always viewed setting a group to be an admin intervention because of doing the chmod and adding the group to various users. So, not sure if this should be better documented or not. But its definitely not audit's job to chgrp -R.
This is not likely to get fixed in RHEL6. Deferring to RHEL7 for future consideration.
Fixed in upstream commit 1284.
audit-2.6.1-1.el7 was built to resolve this issue.
*** Bug 1118313 has been marked as a duplicate of this bug. ***
Successfully reproduced and verified. OLD === # rpm -q audit audit-2.4.1-5.el7.x86_64 # grep -e "^log_" /etc/audit/auditd.conf log_file = /var/log/audit/testgroup-audit.log log_format = RAW log_group = testgroup # kill -s SIGHUP 1619 # ls -l /var/log/audit/ total 108 -rw-------. 1 root root 99474 Jun 30 04:59 audit.log -rw-------. 1 root root 153 Jun 30 05:00 testgroup-audit.log NEW === # rpm -q audit audit-2.6.1-1.el7.x86_64 # grep -e "^log_" /etc/audit/auditd.conf log_file = /var/log/audit/testgroup-audit.log log_group = testgroup log_format = RAW # kill -s SIGHUP 1789 # ls -l /var/log/audit/ total 108 -rw-------. 1 root root 99886 Jun 30 05:01 audit.log -rw-r-----. 1 root testgroup 166 Jun 30 05:03 testgroup-audit.log
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2016-2418.html