Description of problem:
auditd: Error setting audit daemon pid (Invalid argument)
appears in /var/log/messages (at shutdown, when auditd is about to stop)
Version-Release number of selected component (if applicable):
This appears to be related to
At line 471 in audit.c, it now checks for !pid and returns -EINVAL. Setting the pid to 0 is exactly how auditing is supposed to end.
Paul, was this change intended?
What kernel version are we talking about?
# uname -r
My kernel version is :
The problem was already present in previous 4.12 versions.
Since this surely isn't Fedora specific, and because it may be some time before I can address this, let's create an upstream issue tracker.
FYI: this is fixed upstream in the commit below and should be v4.15 which I expect to be released later today.
Laura, is F26 going to see v4.15? If so, I'm not sure it is worth backporting this.
Author: Steve Grubb <firstname.lastname@example.org>
Date: Tue Oct 17 18:29:22 2017 -0400
audit: Allow auditd to set pid to 0 to end auditing
The API to end auditing has historically been for auditd to set the
pid to 0. This patch restores that functionality.
Reviewed-by: Richard Guy Briggs <email@example.com>
Signed-off-by: Steve Grubb <firstname.lastname@example.org>
Signed-off-by: Paul Moore <email@example.com>
Yes, F26 (and F27) will be getting 4.15, probably by the end of February assuming standard kernel timing holds.
Okay, thank you. I'm going to close this as UPSTREAM, if anyone has a strong objection, speak your mind now.