From: Steve Grubb <sgrubb@redhat.com>
To: linux-audit@redhat.com
Cc: "Brown, Thomas" <thomas_brown@mentor.com>
Subject: Re: BUG: segfault on systemctl auditd stop
Date: Wed, 11 Aug 2021 15:04:30 -0400 [thread overview]
Message-ID: <3128346.aeNJFYEL58@x2> (raw)
In-Reply-To: <e09b40ec-26b3-f545-4a58-2c2d79beeea9@mentor.com>
Hello,
On Wednesday, August 11, 2021 1:32:37 PM EDT Brown, Thomas wrote:
> The following auditd segfault occurs during shutdown but can be
> reproduced using the service stop command...
Which version of the audit package is this? There was a known shutdown
problem on 3.0.3 that was fixed in 3.0.4.
> service auditd stop 2root@aug-test:/# 2021 Aug 4 12:47:22 aug-test
> Process 687 (auditd) of user 0 dumped core. 34Stack trace of thread 687:
> 5#0 0x00007f18bb1657e4 fclose (libc.so.6) 6#1 0x000055b88ab50ec0 n/a
> (auditd) 7#2 0x000055b88ab4e421 n/a (auditd) 8#3 0x000055b88ab4d9a7 n/a
> (auditd) 9#4 0x00007f18bb11a09b __libc_start_main (libc.so.6) 10#5
> 0x000055b88ab4df4a n/a (auditd)
This says auditd dumped core on a fclose. My guess would be that it's in
auditd-event.c.
> Setting AUDIT_WRITE_LOGS to "yes" corrects this problem however we have
> a requirement to disable these logs (i.e. AUDIT_WRITE_LOGS needs to be
> set to "no")
>
> After perusing the source I suspect that one of these unconditional
> fclose()s is causing the problem...
Thanks for looking. But the patch applies to standalone utilities rather than
the audit daemon.
<snip>
> However I have not tested these changes. Even though this is a benign
> problem I believe that it warrants a correction. Please open a ticket
> and respond with the ticket id so that we can track this problem/solution.
I am about to release audit-3.0.5 today. I think I see a couple places where
this could use an if (log_file). It would be helpful to know which version of
the audit package that you are using.
Thanks,
-Steve
--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit
prev parent reply other threads:[~2021-08-11 19:06 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-08-11 17:32 BUG: segfault on systemctl auditd stop Brown, Thomas
2021-08-11 19:04 ` Steve Grubb [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3128346.aeNJFYEL58@x2 \
--to=sgrubb@redhat.com \
--cc=linux-audit@redhat.com \
--cc=thomas_brown@mentor.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox