Linux-audit Archive on lore.kernel.org
 help / color / Atom feed
* auditd daemon is changing /tmp permissions
@ 2021-03-04 15:45 Ivan Castell
  2021-03-04 16:05 ` Steve Grubb
  0 siblings, 1 reply; 2+ messages in thread
From: Ivan Castell @ 2021-03-04 15:45 UTC (permalink / raw)
  To: linux-audit

[-- Attachment #1.1: Type: text/plain, Size: 923 bytes --]


Hello all.

Just testing different versions of audit, discovered that version 2.8.5 and 3.0.1 are changing permissions of /tmp from 1777 to 700. This is a problem as normal non-root users can't write in /tmp after starting autitd.

The problem is related with the daemon, as commenting this call:

start-stop-daemon -S -q -p ${PIDFILE} --exec ${DAEMON}

fixes the issue.

It works fine on version 2.8.2.

We fixed temporaly setting proper /tmp permissions after starting the daemon:

# Run audit daemon executable
start-stop-daemon -S -q -p ${PIDFILE} --exec ${DAEMON}

if [ $? = 0 ]; then
# Load the default rules
test -f /etc/audit/rules.d/audit.rules && /usr/sbin/auditctl -R /etc/audit/rules.d/audit.rules >/dev/null
# Bugfix audit 2.8.5 (reported and waiting for a patch!)
chmod 1777 /tmp
echo "OK"
else
echo "FAIL"
fi

Could you provide a temporal patch for the daemon?

Thanks!




[-- Attachment #1.2: Type: text/html, Size: 4852 bytes --]

[-- Attachment #2: Type: text/plain, Size: 106 bytes --]

--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit

^ permalink raw reply	[flat|nested] 2+ messages in thread

* Re: auditd daemon is changing /tmp permissions
  2021-03-04 15:45 auditd daemon is changing /tmp permissions Ivan Castell
@ 2021-03-04 16:05 ` Steve Grubb
  0 siblings, 0 replies; 2+ messages in thread
From: Steve Grubb @ 2021-03-04 16:05 UTC (permalink / raw)
  To: linux-audit; +Cc: Ivan Castell

Hello,

On Thursday, March 4, 2021 10:45:03 AM EST Ivan Castell wrote:
> Just testing different versions of audit, discovered that version 2.8.5 and
> 3.0.1 are changing permissions of /tmp from 1777 to 700. This is a problem
> as normal non-root users can't write in /tmp after starting autitd.
> 
> The problem is related with the daemon, as commenting this call:
> 
> start-stop-daemon -S -q -p ${PIDFILE} --exec ${DAEMON}
> 
> fixes the issue.
> 
> It works fine on version 2.8.2.
> 
> We fixed temporaly setting proper /tmp permissions after starting the
> daemon:
> 
> # Run audit daemon executable
> start-stop-daemon -S -q -p ${PIDFILE} --exec ${DAEMON}
> 
> if [ $? = 0 ]; then
> # Load the default rules
> test -f /etc/audit/rules.d/audit.rules && /usr/sbin/auditctl -R
> /etc/audit/rules.d/audit.rules >/dev/null # Bugfix audit 2.8.5 (reported
> and waiting for a patch!)
> chmod 1777 /tmp
> echo "OK"
> else
> echo "FAIL"
> fi
> 
> Could you provide a temporal patch for the daemon?

Hmm...

[audit-3.0.2]$ grep -rl start-stop-daemon *
[audit-3.0.2]$ grep -rl 'test -f /etc/audit/rules.d/audit.rules' *
[audit-3.0.2]$ 

I don't see this in the audit source code. Which file is this in?

-Steve



--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit


^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, back to index

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-03-04 15:45 auditd daemon is changing /tmp permissions Ivan Castell
2021-03-04 16:05 ` Steve Grubb

Linux-audit Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-audit/0 linux-audit/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-audit linux-audit/ https://lore.kernel.org/linux-audit \
		linux-audit@redhat.com
	public-inbox-index linux-audit

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/com.redhat.linux-audit


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git