Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

For bugs related to Red Hat Enterprise Linux 5 product line. The current stable release is 5.10. For Red Hat Enterprise Linux 6 and above, please visit Red Hat JIRA https://issues.redhat.com/secure/CreateIssue!default.jspa?pid=12332745 to report new issues.

Bug 475278

Summary:	missing audit records for descriptors created by pipe(2) and socketpair(2)
Product:	Red Hat Enterprise Linux 5	Reporter:	Alexander Viro <aviro>
Component:	kernel	Assignee:	Alexander Viro <aviro>
Status:	CLOSED ERRATA	QA Contact:	Red Hat Kernel QE team <kernel-qe>
Severity:	medium	Docs Contact:
Priority:	low
Version:	5.4	CC:	dzickus, sgrubb
Target Milestone:	rc
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2009-09-02 08:54:16 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Alexander Viro 2008-12-08 19:07:13 UTC

Turns out that AUDIT_FD_PAIR patch had not been brought from the mainline; it's been upstream for quite a while and frankly, I assumed it to be in rhel as well.
Without it there's no record left of the descriptors grabbed by pipe(2) and socketpair(2); for open(2) and friends we can get that information from return value (which is recorded), but these two don't do it that way...

Comment 1 RHEL Program Management 2009-01-27 20:38:16 UTC

This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux maintenance release.  Product Management has requested
further review of this request by Red Hat Engineering, for potential
inclusion in a Red Hat Enterprise Linux Update release for currently deployed
products.  This request is not yet committed for inclusion in an Update
release.

Comment 2 RHEL Program Management 2009-02-16 15:45:13 UTC

Updating PM score.

Comment 3 Don Zickus 2009-02-23 20:03:08 UTC

in kernel-2.6.18-132.el5
You can download this test kernel from http://people.redhat.com/dzickus/el5

Please do NOT transition this bugzilla state to VERIFIED until our QE team
has sent specific instructions indicating when to do so.  However feel free
to provide a comment indicating that this fix has been verified.

Comment 6 errata-xmlrpc 2009-09-02 08:54:16 UTC

An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2009-1243.html