Hello, On Thursday, March 4, 2021 10:45:03 AM EST Ivan Castell wrote: > Just testing different versions of audit, discovered that version 2.8.5 and > 3.0.1 are changing permissions of /tmp from 1777 to 700. This is a problem > as normal non-root users can't write in /tmp after starting autitd. > > The problem is related with the daemon, as commenting this call: > > start-stop-daemon -S -q -p ${PIDFILE} --exec ${DAEMON} > > fixes the issue. > > It works fine on version 2.8.2. > > We fixed temporaly setting proper /tmp permissions after starting the > daemon: > > # Run audit daemon executable > start-stop-daemon -S -q -p ${PIDFILE} --exec ${DAEMON} > > if [ $? = 0 ]; then > # Load the default rules > test -f /etc/audit/rules.d/audit.rules && /usr/sbin/auditctl -R > /etc/audit/rules.d/audit.rules >/dev/null # Bugfix audit 2.8.5 (reported > and waiting for a patch!) > chmod 1777 /tmp > echo "OK" > else > echo "FAIL" > fi > > Could you provide a temporal patch for the daemon?
Hmm... [audit-3.0.2]$ grep -rl start-stop-daemon * [audit-3.0.2]$ grep -rl 'test -f /etc/audit/rules.d/audit.rules' * [audit-3.0.2]$ I don't see this in the audit source code. Which file is this in? -Steve -- Linux-audit mailing list Linux-audit@redhat.com https://listman.redhat.com/mailman/listinfo/linux-audit