Created attachment 327637 [details] patch fixing problems described herein Description of problem: We've been doing IDS work and noticed that less is calling fsync on the tty device. This is unsupported and produces EINVAL return codes. How reproducible: always Steps to Reproduce: 1. add this to audit rules: -a always,exit -F fsync -F exit=-EINVAL -k einval 2. open a file with less 3. run ausearch --start recent -k einval Attaching a patch that fixes the problem by testing in autoconf if fsync produces EINVAL when called against the tty descriptor. This requires adding autoreconf to the build section.
Fixed in rawhide less-424-3.fc11.