Hello all.

Just testing different versions of audit, discovered that version 2.8.5 and 3.0.1 are changing permissions of /tmp from 1777 to 700. This is a problem as normal non-root users can't write in /tmp after starting autitd.

The problem is related with the daemon, as commenting this call:

start-stop-daemon -S -q -p ${PIDFILE} --exec ${DAEMON}

fixes the issue.

It works fine on version 2.8.2.

We fixed temporaly setting proper /tmp permissions after starting the daemon:

# Run audit daemon executable
start-stop-daemon -S -q -p ${PIDFILE} --exec ${DAEMON}

if [ $? = 0 ]; then
# Load the default rules
test -f /etc/audit/rules.d/audit.rules && /usr/sbin/auditctl -R /etc/audit/rules.d/audit.rules >/dev/null
# Bugfix audit 2.8.5 (reported and waiting for a patch!)
chmod 1777 /tmp
echo "OK"
else
echo "FAIL"
fi

Could you provide a temporal patch for the daemon?

Thanks!