auditd complains about "Error sending signal_info request" when the system is shutting down or rebooting.
Aug 27 15:49:06 arturo usbhid-ups: Signal 15: exiting
Aug 27 15:49:06 arturo rpc.statd: Caught signal 15, un-registering and exiting.
Aug 27 15:49:07 arturo rpcbind: rpcbind terminating on signal. Restart with "rpcbind -w"
Aug 27 15:49:07 arturo auditd: Error sending signal_info request (Operation not supported)
Aug 27 15:49:07 arturo auditd: The audit daemon is exiting.
Sorry, forgot to say I am using audit-1.7.13-1.fc11.x86_64
Do you get that message when just restarting the audit daemon?
service auditd restart
Yes, I do get the same message when restarting the daemon.
Ok, that's good. It would be helpful get an strace of auditd shutting down. While its running, get the pid of the audit daemon. Then attach strace to it like this:
strace -p <pid> > strace.log 2>&1
Then in another terminal, service auditd stop. I'm not seeing it happen here. Also, what kernel are you running?
Created attachment 359095 [details]
strace of auditd
Here is the strace. I am running kernel 220.127.116.11-217.2.16.fc11.x86_64.
Do you have SELinux disabled?
Let me restate, did you rebuild your kernel without CONFIG_SECURITY.
reassigning to kernel and to me, I see the problem.
I did not rebuild the kernel. SELinux is in permissive mode.
err = security_secid_to_secctx(audit_sig_sid, &ctx, &len);
int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
return security_ops->secid_to_secctx(secid, secdata, seclen);
static int cap_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
Just need to check the return from security_secid_to_secctx() in the audit code and not bail on EOPNOTSUPP;
It should be 'relatively' harmless, you aren't getting all the logging you should, but that's the only problem. I'll get it fixed up.
Sorry, disabled, not permissive.