Bug 1657944 - sos-audit uninstall leaves broken symlinks in /etc/audit/rules.d
Summary: sos-audit uninstall leaves broken symlinks in /etc/audit/rules.d
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: sos
Version: 8.0
Hardware: All
OS: Linux
unspecified
unspecified
Target Milestone: rc
: 8.0
Assignee: Pavel Moravec
QA Contact: Miroslav Hradílek
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-12-10 19:21 UTC by John Pittman
Modified: 2019-06-14 01:12 UTC (History)
7 users (show)

Fixed In Version: sos-3.6-8.el8
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-06-14 01:12:01 UTC
Type: Bug
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Knowledge Base (Solution) 3747591 None None None 2018-12-10 19:55:32 UTC

Description John Pittman 2018-12-10 19:21:29 UTC
Description of problem:

sos-audit uninstall leaves broken symlinks in /etc/audit/rules.d

Version-Release number of selected component (if applicable):

sos-audit-3.6-7.el8.noarch

Steps to Reproduce:

# yum -y install sos-audit

[root@localhost ~]# rpm -qf /etc/audit/rules.d/40-sos-storage.rules 
file /etc/audit/rules.d/40-sos-storage.rules is not owned by any package

[root@localhost ~]# ls -lah /usr/lib/sos/audit/rules.d/40*
-r--r--r-- 1 root root 3.9K Aug 10 10:42 /usr/lib/sos/audit/rules.d/40-sos-filesystem.rules
-r--r--r-- 1 root root 3.9K Aug 10 10:42 /usr/lib/sos/audit/rules.d/40-sos-storage.rules

[root@localhost ~]# ls -lah /etc/audit/rules.d/40*
lrwxrwxrwx 1 root root 50 Dec 10 14:03 /etc/audit/rules.d/40-sos-filesystem.rules -> /usr/lib/sos/audit/rules.d/40-sos-filesystem.rules
lrwxrwxrwx 1 root root 47 Dec 10 14:03 /etc/audit/rules.d/40-sos-storage.rules -> /usr/lib/sos/audit/rules.d/40-sos-storage.rules

# yum remove sos-audit

[root@localhost ~]# ls -lah /usr/lib/sos/audit/rules.d/40*
ls: cannot access '/usr/lib/sos/audit/rules.d/40*': No such file or directory

[root@localhost ~]# ls -lah /etc/audit/rules.d/40*
lrwxrwxrwx 1 root root 50 Dec 10 14:03 /etc/audit/rules.d/40-sos-filesystem.rules -> /usr/lib/sos/audit/rules.d/40-sos-filesystem.rules
lrwxrwxrwx 1 root root 47 Dec 10 14:03 /etc/audit/rules.d/40-sos-storage.rules -> /usr/lib/sos/audit/rules.d/40-sos-storage.rules


Actual results:

broken symlink remains in /etc/audit/rules.d after sos-audit removal

Expected results:

symlink should be cleaned up

Comment 1 Pavel Moravec 2018-12-11 08:00:58 UTC
Thanks for spotting it - this is already discussed in the original RFE:

https://bugzilla.redhat.com/show_bug.cgi?id=1601084#c59

We can resolve this flaw within that BZ and close this one as duplicate, or track this symlink issue here separately - both is ok for me.

Some feedback about preferences in solutions described in https://bugzilla.redhat.com/show_bug.cgi?id=1601084#c59 (and in above comments) would be great / pending on it. With no feedback in few days (when I should re-spin), I will resolve it by hardcoded:

%ghost /etc/audit/rules.d/40-sos-filesystem.rules
%ghost /etc/audit/rules.d/40-sos-storage.rules

in sos.spec.

Comment 2 John Pittman 2018-12-11 13:16:58 UTC
Great Pavel!  Thanks for responding so quickly.  If it doesn't matter to you, I would like to track this issue here because I've made a public KCS that references this BZ for customers.  The other bug is private and has a lot of info prior to beta so I am wary of making it public.

Comment 4 Pavel Moravec 2018-12-14 12:13:41 UTC
This can be optionally tested by the reporter:

A yum repository for the build of sos-3.6-8.el8 (task 19510986) is available at:

http://brew-task-repos.usersys.redhat.com/repos/official/sos/3.6/8.el8/

You can install the rpms locally by putting this .repo file in your /etc/yum.repos.d/ directory:

http://brew-task-repos.usersys.redhat.com/repos/official/sos/3.6/8.el8/sos-3.6-8.el8.repo

RPMs and build logs can be found in the following locations:
http://brew-task-repos.usersys.redhat.com/repos/official/sos/3.6/8.el8/noarch/

The full list of available rpms is:
http://brew-task-repos.usersys.redhat.com/repos/official/sos/3.6/8.el8/noarch/sos-3.6-8.el8.src.rpm
http://brew-task-repos.usersys.redhat.com/repos/official/sos/3.6/8.el8/noarch/sos-3.6-8.el8.noarch.rpm
http://brew-task-repos.usersys.redhat.com/repos/official/sos/3.6/8.el8/noarch/sos-audit-3.6-8.el8.noarch.rpm

Build output will be available for the next 21 days.

Comment 5 John Pittman 2018-12-14 14:41:57 UTC
Thanks Pavel.  Works fine.

[root@localhost ~]# rpm -ivh sos-3.6-8.el8.noarch.rpm sos-audit-3.6-8.el8.noarch.rpm
Verifying...                          ################################# [100%]
Preparing...                          ################################# [100%]
Updating / installing...
   1:sos-audit-3.6-8.el8              ################################# [ 50%]
Currently-enabled sos-audit rules in /etc/audit/rules.d are:
40-sos-filesystem.rules
40-sos-storage.rules
NOTE: Audit rules changed in /etc/audit/rules.d. Run 'augenrules --load' to activate the new rules.
   2:sos-3.6-8.el8                    ################################# [100%]

[root@localhost ~]# ls /etc/audit/rules.d/*
/etc/audit/rules.d/40-sos-filesystem.rules  /etc/audit/rules.d/40-sos-storage.rules  /etc/audit/rules.d/audit.rules

[root@localhost ~]# yum remove sos sos-audit
Updating Subscription Management repositories.
Updating Subscription Management repositories.
....snip

[root@localhost ~]# ls /etc/audit/rules.d/*
/etc/audit/rules.d/audit.rules


Note You need to log in before you can comment on or make changes to this bug.