From: Steve Grubb <sgrubb@redhat.com>
To: linux-audit@redhat.com
Cc: "Brown, Thomas" <thomas_brown@mentor.com>
Subject: Re: BUG: segfault on systemctl auditd stop
Date: Wed, 11 Aug 2021 15:04:30 -0400 [thread overview]
Message-ID: <3128346.aeNJFYEL58@x2> (raw)
In-Reply-To: <e09b40ec-26b3-f545-4a58-2c2d79beeea9@mentor.com>
Hello,
On Wednesday, August 11, 2021 1:32:37 PM EDT Brown, Thomas wrote:
> The following auditd segfault occurs during shutdown but can be
> reproduced using the service stop command...
Which version of the audit package is this? There was a known shutdown
problem on 3.0.3 that was fixed in 3.0.4.
> service auditd stop 2root@aug-test:/# 2021 Aug 4 12:47:22 aug-test
> Process 687 (auditd) of user 0 dumped core. 34Stack trace of thread 687:
> 5#0 0x00007f18bb1657e4 fclose (libc.so.6) 6#1 0x000055b88ab50ec0 n/a
> (auditd) 7#2 0x000055b88ab4e421 n/a (auditd) 8#3 0x000055b88ab4d9a7 n/a
> (auditd) 9#4 0x00007f18bb11a09b __libc_start_main (libc.so.6) 10#5
> 0x000055b88ab4df4a n/a (auditd)
This says auditd dumped core on a fclose. My guess would be that it's in
auditd-event.c.
> Setting AUDIT_WRITE_LOGS to "yes" corrects this problem however we have
> a requirement to disable these logs (i.e. AUDIT_WRITE_LOGS needs to be
> set to "no")
>
> After perusing the source I suspect that one of these unconditional
> fclose()s is causing the problem...
Thanks for looking. But the patch applies to standalone utilities rather than
the audit daemon.
<snip>
> However I have not tested these changes. Even though this is a benign
> problem I believe that it warrants a correction. Please open a ticket
> and respond with the ticket id so that we can track this problem/solution.
I am about to release audit-3.0.5 today. I think I see a couple places where
this could use an if (log_file). It would be helpful to know which version of
the audit package that you are using.
Thanks,
-Steve
--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit
prev parent reply other threads:[~2021-08-11 19:06 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-08-11 17:32 BUG: segfault on systemctl auditd stop Brown, Thomas
2021-08-11 19:04 ` Steve Grubb [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3128346.aeNJFYEL58@x2 \
--to=sgrubb@redhat.com \
--cc=linux-audit@redhat.com \
--cc=thomas_brown@mentor.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.