Bug 654883 - service auditd restart output in immutable mode is not clear.
service auditd restart output in immutable mode is not clear.
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: audit (Show other bugs)
x86_64 Linux
medium Severity medium
: rc
: ---
Assigned To: Steve Grubb
Ondrej Moriš
Depends On:
  Show dependency treegraph
Reported: 2010-11-18 17:39 EST by Raghu Udiyar
Modified: 2012-02-21 01:37 EST (History)
1 user (show)

See Also:
Fixed In Version: audit-1.8-1.el5
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2012-02-21 01:37:53 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Raghu Udiyar 2010-11-18 17:39:51 EST
Description of problem:

When auditd is in immutable mode and auditd service is restarted you get the message "The audit system is in immutable mode, no rules loaded." 

This is confusing. Since the original rules are loaded. Its' just that once they are loaded they can't be changed without a reboot.

Perhaps "The audit system is in immutable mode, no changes allowed" would be more clear.

Version-Release number of selected component (if applicable): audit-1.7.17-3.el5

How reproducible: Always

Steps to Reproduce:
1. Add "-e 2" to /etc/audit/audit.rules file.
2. Run "service auditd restart". This puts audit in immutable mode.
3. Any subsequent attempt to restart the service throws the message : "The audit system is in immutable mode, no rules loaded"
Actual results: The message is unclear and misleading.

Expected results: "no rules loaded" should be changed to something else.

Additional info:
Comment 1 Steve Grubb 2011-01-15 09:42:16 EST
Patch committed upstream.
Comment 2 Raghu Udiyar 2011-01-17 06:02:48 EST
Thank you.
Comment 4 Steve Grubb 2011-10-27 11:39:01 EDT
audit-1.8-1.el5 was built to address this problem.
Comment 7 errata-xmlrpc 2012-02-21 01:37:53 EST
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.