Bug 2070706

+++ This bug was initially created as a clone of Bug #2070705 +++

Description of problem:

With the default audit configuration, watch rules in some directories are blocked.

This issue was reported upstream here [1] and fixed here [2].

Current auditd systemd service has a "ProtectHome=true" directive, which, as per systemd.exec(5) man page, "If true, the directories /home/, /root, and /run/user are made inaccessible and empty for processes invoked by this unit."

As Paul explains in [1], "What is happening is that when you load an audit rule to watch a file like you are doing here, the kernel leverages some internal functionality to "tag" the file so that the audit subsystem is notified when it is accessed. With the systemd config above the "/home" and "/root" directories are not the same between when the audit rules are loaded and when the system is available for interactive use."


Version-Release number of selected component (if applicable): audit-3.0.7-3.el8

How reproducible: always

Steps to Reproduce:
1. Create a /etc/audit/rules.d/extra.rules file with the following content:

-w /root/testfile -p rwxa -k test-root
-w /home/testfile -p rwxa -k test-home

2. Restart the audit daemon: # service auditd restart

3. Write to both files:
# start=$(date "+%T")
# echo 1 >  /root/testfile
# echo 2 > /home/testfile
# end=$(date "+%T")

4. Use ausearch to search for the test keys:
# ausearch -ts ${start} -te ${end} -k test-root --format text
# ausearch -ts ${start} -te ${end} -k test-home --format text


Actual results:
# ausearch -ts ${start} -te ${end} -k test-root --format text
<no matches>

# ausearch -ts ${start} -te ${end} -k test-home --format text
<no matches>

Expected results:
# ausearch -ts ${start} -te ${end} -k test-root --format text
At 13:22:58 03/31/2022 root successfully opened-file /root/testfile using bash

# ausearch -ts ${start} -te ${end} -k test-home --format text
At 13:23:01 03/31/2022 root successfully opened-file /home/testfile using bash


Additional info: This change was introduced in 3.0.3 [3].


[1] https://github.com/linux-audit/audit-userspace/issues/256 
[2] https://github.com/linux-audit/audit-userspace/commit/12cf14eda9fadeb7337a44653a80a57456afbb34
[3] https://github.com/linux-audit/audit-userspace/commit/3fcaa9