Red Hat Bugzilla – Bug 477610
less' use of fsync makes EINVAL
Last modified: 2009-03-17 03:51:10 EDT
Created attachment 327637 [details]
patch fixing problems described herein
Description of problem:
We've been doing IDS work and noticed that less is calling fsync on the tty device. This is unsupported and produces EINVAL return codes.
Steps to Reproduce:
1. add this to audit rules: -a always,exit -F fsync -F exit=-EINVAL -k einval
2. open a file with less
3. run ausearch --start recent -k einval
Attaching a patch that fixes the problem by testing in autoconf if fsync produces EINVAL when called against the tty descriptor. This requires adding autoreconf to the build section.
Fixed in rawhide less-424-3.fc11.