The following has be reported by IBM LTC: LAuS: /etc/init.d/audit expect a file named /sbin/auditd64 on PPC64 arch, but no such file shipped in RHEL3 U2 Beta Hardware Environment: P630 Software Environment: 03/30 released RHEL3 U2 Beta, with the kernel updated to 2.4.21-13.EL LAuS package laud-0.1-48RHEL3(Linux Audit Subsystem), which was added into RHEL at Update2 Beta(03/30) Steps to Reproduce: 1. use /etc/init.d/audit to start LAuS daemon, but no daemon created [root@plinuxt2 root]# /etc/init.d/audit start [root@plinuxt2 root]# ps -ef|grep audit root 8319 6616 0 13:55 pts/15 00:00:00 grep audit [root@plinuxt2 root]# 2. enable -x option to this start script, and find that it need /sbin/auditd64 to work, but there is no /sbin/auditd64 shipped in RHEL3 U2 beta on PPC64 arch [root@plinuxt2 root]# sh -x /etc/init.d/audit start + test -s /etc/sysconfig/audit + initdir=/etc/init.d + . /etc/init.d/functions ...... ++ arch + '[' ppc64 = ppc64 ']' + AUDITD_BIN=/sbin/auditd64 + test -x /sbin/auditd64 + exit 5 3. Actual Results: /etc/init.d/audit could start audit daemon Expected Results: Additional Information: Following is the content of laus package shipped in RHEL3 U2 Beta. It seems that there are two set of files: one for 32bits and one for 64bits, but the 64bits files overwrite the 32bits ones: ================ The detailed information of laus package ================== [root@plinuxt2 root]# rpm -qil laus Name : laus Relocations: (not relocatable) Version : 0.1 Vendor: Red Hat, Inc. Release : 48RHEL3 Build Date: Tue 09 Mar 2004 11:09:34 PM CST Install Date: Wed 07 Apr 2004 03:47:48 PM CST Build Host: cure81.devel.redhat.com Group : System/Monitoring Source RPM: laus-0.1-48RHEL3.src.rpm Size : 287285 License: GPL Signature : DSA/SHA1, Thu 11 Mar 2004 03:13:00 AM CST, Key ID fd372689897da07a Packager : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla> Summary : Linux Audit-Subsystem user space tools and daemon Description : This package includes all user space utilities needed for handling the Linux Audit-Subsystem (LAuS). The following components are included: - audit daemon - audit tools - PAM module - liblaus - liblaussrv - man pages Your kernel has to support system call auditing to make these tools work. Authors: -------- Olaf Kirch <okir> Thomas Biege <thomas> /etc/audit /etc/audit/audit.conf /etc/audit/filesets.conf /etc/audit/filter.conf /etc/init.d/audit /lib/security/pam_laus.so /sbin/auditd /usr/lib/liblaus.so.1 /usr/lib/liblaus.so.1.0.0 /usr/lib/liblaussrv.so.0 /usr/lib/liblaussrv.so.0.0.0 /usr/sbin/aucat /usr/sbin/audbin /usr/sbin/augrep /usr/sbin/aurun /usr/share/doc/laus-0.1 /usr/share/doc/laus-0.1/AUTHORS /usr/share/doc/laus-0.1/COPYING /usr/share/doc/laus-0.1/ChangeLog /usr/share/doc/laus-0.1/INSTALL /usr/share/doc/laus-0.1/NEWS /usr/share/doc/laus-0.1/README /usr/share/doc/laus-0.1/TODO /usr/share/man/man1/aucat.1.gz /usr/share/man/man1/audbin.1.gz /usr/share/man/man1/augrep.1.gz /usr/share/man/man4/audit.4.gz /usr/share/man/man5/audit-filesets.conf.5.gz /usr/share/man/man5/audit-filter.conf.5.gz /usr/share/man/man5/audit.conf.5.gz /usr/share/man/man7/laus-fields.7.gz /usr/share/man/man7/laus-record.7.gz /usr/share/man/man7/laus.7.gz /usr/share/man/man8/auditd.8.gz /usr/share/man/man8/aurun.8.gz Name : laus Relocations: (not relocatable) Version : 0.1 Vendor: Red Hat, Inc. Release : 48RHEL3 Build Date: Tue 09 Mar 2004 11:10:18 PM CST Install Date: Wed 07 Apr 2004 03:47:49 PM CST Build Host: stagg.build.redhat.com Group : System/Monitoring Source RPM: laus-0.1-48RHEL3.src.rpm Size : 376101 License: GPL Signature : DSA/SHA1, Thu 11 Mar 2004 03:12:59 AM CST, Key ID fd372689897da07a Packager : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla> Summary : Linux Audit-Subsystem user space tools and daemon Description : This package includes all user space utilities needed for handling the Linux Audit-Subsystem (LAuS). The following components are included: - audit daemon - audit tools - PAM module - liblaus - liblaussrv - man pages Your kernel has to support system call auditing to make these tools work. Authors: -------- Olaf Kirch <okir> Thomas Biege <thomas> /etc/audit /etc/audit/audit.conf /etc/audit/filesets.conf /etc/audit/filter.conf /etc/init.d/audit /lib64/security/pam_laus.so /sbin/auditd /usr/lib64/liblaus.so.1 /usr/lib64/liblaus.so.1.0.0 /usr/lib64/liblaussrv.so.0 /usr/lib64/liblaussrv.so.0.0.0 /usr/sbin/aucat /usr/sbin/audbin /usr/sbin/augrep /usr/sbin/aurun /usr/share/doc/laus-0.1 /usr/share/doc/laus-0.1/AUTHORS /usr/share/doc/laus-0.1/COPYING /usr/share/doc/laus-0.1/ChangeLog /usr/share/doc/laus-0.1/INSTALL /usr/share/doc/laus-0.1/NEWS /usr/share/doc/laus-0.1/README /usr/share/doc/laus-0.1/TODO /usr/share/man/man1/aucat.1.gz /usr/share/man/man1/audbin.1.gz /usr/share/man/man1/augrep.1.gz /usr/share/man/man4/audit.4.gz /usr/share/man/man5/audit-filesets.conf.5.gz /usr/share/man/man5/audit-filter.conf.5.gz /usr/share/man/man5/audit.conf.5.gz /usr/share/man/man7/laus-fields.7.gz /usr/share/man/man7/laus-record.7.gz /usr/share/man/man7/laus.7.gz /usr/share/man/man8/auditd.8.gz /usr/share/man/man8/aurun.8.gzOne more finding: [root@plinuxt2 root]# rpm -qa|grep laus laus-devel-0.1-48RHEL3 laus-0.1-48RHEL3 laus-0.1-48RHEL3 what is the difference between the last two? Maybe the second one should be named laus64, and the corresponding binary should renamed to /sbin/auditd64. Just my guess. Thanks.
This should be fixed in 0.1-50RHEL3 and later. Please check.
----- Additional Comments From zhouwu.com 2004-04-27 21:20 ------- Could you tell me in which release will this new package be shipped? So I can check this once the release is available. Thanks.
----- Additional Comments From zhouwu.com 2004-05-09 01:52 ------- Yes, this defect is fixed with the latest version:0.1-54RHEL3. We have just maken a verification on 05/05 release U2 RC. Thanks.
We are still seeing this issue in U3 candidate trees. The laus version is laus-0.1-62RHEL3. Duplicating the new bug reported by IBM LTC...
*** Bug 126779 has been marked as a duplicate of this bug. ***
I see both a ppc and a ppc64 version of the laus rpm...however both packages provide a /sbin/auditd. And it appears that the 32b version of /sbin/auditd attempts to execv /sbin/auditd64 which doesn't exist: # file /sbin/auditd /sbin/auditd: ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV), for GNU/Linux 2.2.5, dynamically linked (uses shared libs), stripped # strace /sbin/auditd open("/lib/tls/libc.so.6", O_RDONLY) = 3 read(3, "\177ELF\1\2\1\0\0\0\0\0\0\0\0\0\0\3\0\24\0\0\0\1\0\1\301"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=1605852, ...}) = 0 mmap(0xfe47000, 1399388, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) = 0xfe47000 mprotect(0xff86000, 92764, PROT_NONE) = 0 mmap(0xff87000, 81920, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 0x130000) = 0xff87000 mmap(0xff9b000, 6748, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xff9b000 close(3) = 0 munmap(0x40028000, 97594) = 0 uname({sys="Linux", node="localhost.localdomain", ...}) = 0 brk(0) = 0x1001d000 brk(0x1003e000) = 0x1003e000 brk(0) = 0x1003e000 execve("/sbin/auditd64", ["/sbin/auditd64"], [/* 24 vars */]) = -1 ENOENT (No such file or directory) dup(2) = 3 fcntl64(3, F_GETFL) = 0x2 (flags O_RDWR) fstat64(3, {st_mode=S_IFCHR|0620, st_rdev=makedev(229, 0), ...}) = 0 ioctl(3, TCGETS or TCGETS, {B38400 opost isig icanon echo ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40028000 _llseek(3, 0, 0xffffa4b8, SEEK_CUR) = -1 ESPIPE (Illegal seek) write(3, "/sbin/auditd64: No such file or "..., 42/sbin/auditd64: No such file or directory It appears that installing the ppc64 version of laus (laus-0.1-62RHEL3.ppc64.rpm) corrects the issue and auditd is able to startup without error. The current beta candidate tree contains only the following laus packages. Looking at the following package list, it doesn't appear that the beta candidate trees solve the problem. laus-0.1-62RHEL3.ppc.rpm laus-libs-0.1-62RHEL3.ppc64.rpm laus-devel-0.1-62RHEL3.ppc.rpm laus-libs-0.1-62RHEL3.ppc.rpm Thoughts?
There's not supposed to be a 32-bit auditd on ppc64. Let me dig into this and get it fixed. 32-bit laus-libs are provided only to keep the 32-bit PAM happy.
Fixed.