* auditd daemon is changing /tmp permissions
@ 2021-03-04 15:45 Ivan Castell
2021-03-04 16:05 ` Steve Grubb
0 siblings, 1 reply; 2+ messages in thread
From: Ivan Castell @ 2021-03-04 15:45 UTC (permalink / raw)
To: linux-audit
[-- Attachment #1.1: Type: text/plain, Size: 923 bytes --]
Hello all.
Just testing different versions of audit, discovered that version 2.8.5 and 3.0.1 are changing permissions of /tmp from 1777 to 700. This is a problem as normal non-root users can't write in /tmp after starting autitd.
The problem is related with the daemon, as commenting this call:
start-stop-daemon -S -q -p ${PIDFILE} --exec ${DAEMON}
fixes the issue.
It works fine on version 2.8.2.
We fixed temporaly setting proper /tmp permissions after starting the daemon:
# Run audit daemon executable
start-stop-daemon -S -q -p ${PIDFILE} --exec ${DAEMON}
if [ $? = 0 ]; then
# Load the default rules
test -f /etc/audit/rules.d/audit.rules && /usr/sbin/auditctl -R /etc/audit/rules.d/audit.rules >/dev/null
# Bugfix audit 2.8.5 (reported and waiting for a patch!)
chmod 1777 /tmp
echo "OK"
else
echo "FAIL"
fi
Could you provide a temporal patch for the daemon?
Thanks!
[-- Attachment #1.2: Type: text/html, Size: 4852 bytes --]
[-- Attachment #2: Type: text/plain, Size: 106 bytes --]
--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: auditd daemon is changing /tmp permissions
2021-03-04 15:45 auditd daemon is changing /tmp permissions Ivan Castell
@ 2021-03-04 16:05 ` Steve Grubb
0 siblings, 0 replies; 2+ messages in thread
From: Steve Grubb @ 2021-03-04 16:05 UTC (permalink / raw)
To: linux-audit; +Cc: Ivan Castell
Hello,
On Thursday, March 4, 2021 10:45:03 AM EST Ivan Castell wrote:
> Just testing different versions of audit, discovered that version 2.8.5 and
> 3.0.1 are changing permissions of /tmp from 1777 to 700. This is a problem
> as normal non-root users can't write in /tmp after starting autitd.
>
> The problem is related with the daemon, as commenting this call:
>
> start-stop-daemon -S -q -p ${PIDFILE} --exec ${DAEMON}
>
> fixes the issue.
>
> It works fine on version 2.8.2.
>
> We fixed temporaly setting proper /tmp permissions after starting the
> daemon:
>
> # Run audit daemon executable
> start-stop-daemon -S -q -p ${PIDFILE} --exec ${DAEMON}
>
> if [ $? = 0 ]; then
> # Load the default rules
> test -f /etc/audit/rules.d/audit.rules && /usr/sbin/auditctl -R
> /etc/audit/rules.d/audit.rules >/dev/null # Bugfix audit 2.8.5 (reported
> and waiting for a patch!)
> chmod 1777 /tmp
> echo "OK"
> else
> echo "FAIL"
> fi
>
> Could you provide a temporal patch for the daemon?
Hmm...
[audit-3.0.2]$ grep -rl start-stop-daemon *
[audit-3.0.2]$ grep -rl 'test -f /etc/audit/rules.d/audit.rules' *
[audit-3.0.2]$
I don't see this in the audit source code. Which file is this in?
-Steve
--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-03-04 16:05 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-03-04 15:45 auditd daemon is changing /tmp permissions Ivan Castell
2021-03-04 16:05 ` Steve Grubb
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).