From mboxrd@z Thu Jan  1 00:00:00 1970
From: Steve Grubb <sgrubb@redhat.com>
Subject: Re: audit 1.6.4 released
Date: Mon, 31 Dec 2007 09:39:48 -0500
Message-ID: <200712310939.49095.sgrubb@redhat.com>
References: <200712291044.10368.sgrubb@redhat.com>
	<1199031881.3716.2.camel@localhost.localdomain>
Mime-Version: 1.0
Content-Type: text/plain;
  charset="utf-8"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
In-Reply-To: <1199031881.3716.2.camel@localhost.localdomain>
Content-Disposition: inline
List-Unsubscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: Eric Paris <eparis@redhat.com>
Cc: Linux Audit <linux-audit@redhat.com>
List-Id: linux-audit@redhat.com

On Sunday 30 December 2007 11:24:41 am Eric Paris wrote:
> On Sat, 2007-12-29 at 10:44 -0500, Steve Grubb wrote:
> > This release fixes a major bug that got introduced in the last release.
> > The code that fixes a permission problem was using the wrong variable. It
> > happens that the result was applied to /dev/null instead of the audit
> > log. If you had selinux in enforcing mode - nothing happened, for
> > everyone else.../dev/null probably got messed up. Oopsie.
>
> close, so close.
>
> Now auditd is fchmoding /var/log/audit/audit.log to 600 and everything
> works fine.  But run 'service auditd restart' or just reboot and audit
> will refuse to start!

I forgot to change the parser to allow this config. The following patch was
applied to Fedora rawhide. It will be in the 1.6.5 release sometime soon. I
want to fix a couple more things before releasing 1.6.5.

-Steve


diff -urp audit-1.6.5.orig/src/auditd-config.c audit-1.6.5/src/auditd-config.c
--- audit-1.6.5.orig/src/auditd-config.c	2007-12-30 17:01:29.000000000 -0500
+++ audit-1.6.5/src/auditd-config.c	2007-12-30 17:07:45.000000000 -0500
@@ -505,9 +505,9 @@ static int log_file_parser(struct nv_pai
 		audit_msg(LOG_ERR, "%s is not owned by root", nv->value);
 		return 1;
 	}
-	if ((buf.st_mode & (S_IRWXU|S_IRWXG|S_IRWXO)) != 
-			  (S_IRUSR|S_IWUSR|S_IRGRP)) {
-		audit_msg(LOG_ERR, "%s permissions should be 0640", nv->value);
+	if ( (buf.st_mode & (S_IXUSR|S_IWGRP|S_IXGRP|S_IRWXO)) ) {
+		audit_msg(LOG_ERR, "%s permissions should be 0600 or 0640",
+				nv->value);
 		return 1;
 	}
 	free((void *)config->log_file);