Hide Forgot
+++ This bug was initially created as a clone of Bug #695419 +++ Description of problem: audisp-remote does > memset (&address, 0, sizeof(address)); > address.sin_family = htons(AF_INET); > address.sin_port = htons(config.local_port); > address.sin_addr.s_addr = htonl(INADDR_ANY); which shows in strace as > bind(3, {sa_family=0x200 /* AF_??? */, sa_data="\0<\0\0\0\0\0\0\0\0\0\0\0\0"}, 16) = 0 For some reason the call still succeeds, but a correct invocation would not call htons on AF_INET. --- Additional comment from sgrubb on 2011-04-11 13:26:40 EDT --- It works because the audit daemon also has a matching mistake. Fixed in revision 505. --- Additional comment from tmraz on 2011-04-12 02:33:47 EDT --- And is the daemon really listening on IPv4 port in this case or not?
Two other issues that needs to be addressed at the same time: 1) capabilities are completely dropped. Any reconnect due to the server going down will fail if local_port is < 1024. 2) When audispd restarts a plugin, it does not mark the plugin as active. This means that even though its running, events will not be forwarded to the plugin.
audit-2.1-3.el6 was built to resolve this problem.
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on therefore solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHBA-2011-0653.html