Hello all.
Just testing different versions of audit, discovered that version 2.8.5 and
3.0.1 are changing permissions of /tmp from 1777 to 700. This is a problem as
normal non-root users can't write in /tmp after starting autitd.
The problem is related with the daemon, as commenting this call:
start-stop-daemon -S -q -p ${PIDFILE} --exec ${DAEMON}
fixes the issue.
It works fine on version 2.8.2.
We fixed temporaly setting proper /tmp permissions after starting the daemon:
# Run audit daemon executable
start-stop-daemon -S -q -p ${PIDFILE} --exec ${DAEMON}
if [ $? = 0 ]; then
# Load the default rules
test -f /etc/audit/rules.d/audit.rules && /usr/sbin/auditctl -R
/etc/audit/rules.d/audit.rules >/dev/null
# Bugfix audit 2.8.5 (reported and waiting for a patch!)
chmod 1777 /tmp
echo "OK"
else
echo "FAIL"
fi
Could you provide a temporal patch for the daemon?
Thanks!
--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit
