auditd daemon is changing /tmp permissions

auditd daemon is changing /tmp permissions

[Ivan Castell]

[-- Attachment #1.1: Type: text/plain, Size: 923 bytes --]


Hello all.

Just testing different versions of audit, discovered that version 2.8.5 and 3.0.1 are changing permissions of /tmp from 1777 to 700. This is a problem as normal non-root users can't write in /tmp after starting autitd.

The problem is related with the daemon, as commenting this call:

start-stop-daemon -S -q -p ${PIDFILE} --exec ${DAEMON}

fixes the issue.

It works fine on version 2.8.2.

We fixed temporaly setting proper /tmp permissions after starting the daemon:

# Run audit daemon executable
start-stop-daemon -S -q -p ${PIDFILE} --exec ${DAEMON}

if [ $? = 0 ]; then
# Load the default rules
test -f /etc/audit/rules.d/audit.rules && /usr/sbin/auditctl -R /etc/audit/rules.d/audit.rules >/dev/null
# Bugfix audit 2.8.5 (reported and waiting for a patch!)
chmod 1777 /tmp
echo "OK"
else
echo "FAIL"
fi

Could you provide a temporal patch for the daemon?

Thanks!




[-- Attachment #1.2: Type: text/html, Size: 4852 bytes --]

[-- Attachment #2: Type: text/plain, Size: 106 bytes --]

--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit

Re: auditd daemon is changing /tmp permissions

[Steve Grubb]

Hello,

On Thursday, March 4, 2021 10:45:03 AM EST Ivan Castell wrote:
> Just testing different versions of audit, discovered that version 2.8.5 and
> 3.0.1 are changing permissions of /tmp from 1777 to 700. This is a problem
> as normal non-root users can't write in /tmp after starting autitd.
> 
> The problem is related with the daemon, as commenting this call:
> 
> start-stop-daemon -S -q -p ${PIDFILE} --exec ${DAEMON}
> 
> fixes the issue.
> 
> It works fine on version 2.8.2.
> 
> We fixed temporaly setting proper /tmp permissions after starting the
> daemon:
> 
> # Run audit daemon executable
> start-stop-daemon -S -q -p ${PIDFILE} --exec ${DAEMON}
> 
> if [ $? = 0 ]; then
> # Load the default rules
> test -f /etc/audit/rules.d/audit.rules && /usr/sbin/auditctl -R
> /etc/audit/rules.d/audit.rules >/dev/null # Bugfix audit 2.8.5 (reported
> and waiting for a patch!)
> chmod 1777 /tmp
> echo "OK"
> else
> echo "FAIL"
> fi
> 
> Could you provide a temporal patch for the daemon?

Hmm...

[audit-3.0.2]$ grep -rl start-stop-daemon *
[audit-3.0.2]$ grep -rl 'test -f /etc/audit/rules.d/audit.rules' *
[audit-3.0.2]$ 

I don't see this in the audit source code. Which file is this in?

-Steve



--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit