Sorry, forgot to say I am using audit-1.7.13-1.fc11.x86_64

Do you get that message when just restarting the audit daemon?
service auditd restart

Yes, I do get the same message when restarting the daemon.

Ok, that's good. It would be helpful get an strace of auditd shutting down. While its running, get the pid of the audit daemon. Then attach strace to it like this:

strace -p <pid> > strace.log 2>&1

Then in another terminal, service auditd stop. I'm not seeing it happen here. Also, what kernel are you running?

Created attachment 359095 [details]
strace of auditd

Here is the strace.  I am running kernel 2.6.29.6-217.2.16.fc11.x86_64.

Do you have SELinux disabled?

Let me restate, did you rebuild your kernel without CONFIG_SECURITY.

reassigning to kernel and to me, I see the problem.

I did not rebuild the kernel.  SELinux is in permissive mode.

case AUDIT_SIGNAL_INFO:
                err = security_secid_to_secctx(audit_sig_sid, &ctx, &len);
                if (err)
                        return err;


int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
{
        return security_ops->secid_to_secctx(secid, secdata, seclen);
}

static int cap_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
{
        return -EOPNOTSUPP;
}


Just need to check the return from security_secid_to_secctx() in the audit code and not bail on EOPNOTSUPP;

It should be 'relatively' harmless, you aren't getting all the logging you should, but that's the only problem.  I'll get it fixed up.

Sorry, disabled, not permissive.

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=939cbf260c1abce6cad4b95ea4ba9f5132b660b3