From: Steve Grubb <sgrubb@redhat.com>
To: linux-audit@redhat.com
Subject: Re: space_left_action=exec only works once?
Date: Mon, 27 Mar 2017 22:31:53 -0400 [thread overview]
Message-ID: <3656144.K4VNvzPEl7@x2> (raw)
In-Reply-To: <20170126072210.5630c661@ivy-bridge>
On Thursday, January 26, 2017 1:22:10 AM EDT Steve Grubb wrote:
> Hello,
>
> On Wed, 25 Jan 2017 15:06:50 -0800
>
> Bond Masuda <bond.masuda@jlbond.com> wrote:
> > I configured space_left and space_left_action to run a script that
> > compresses and moves older audit log files from /var/log/audit. It
> > appears to work 1 time, and then doesn't work anymore until I kill
> > the auditd daemon and start it again.
> >
> > Is this expected and/or desired behavior? I didn't see anything in
> > the man pages about this behavior. I was hoping to have my script run
> > every time the space_left threshold is hit so as to not run out of
> > logging disk space. Is there something I can do to accomplish this?
>
> You may need to send SIGUSR2 to `pidof auditd` to reset the internal
> counters. Let me know if that does not fix it.
I dug into this in detail today. I apologize for how long it took, but our QE
guy showed me how to reproduce this without losing a couple years of audit
logs I use for testing and research.
In any event, your script must send sigusr2 to the audit daemon the man page
documents this by saying to use "service auditd resume". SE Linux denies this
by default. So, you might have an AVC. I'll open a bz against selinux policy
to ask for allowance on this.
But I did find one issue. When there is an exec action, auditd really should
close its logging descriptor so that it's not writing to a deleted file. Then
on SIGUSR2, it should re-open the descriptor. This was pushed into git today.
So, the next release, which is tomorrow, will have a fix so that if your script
sends SIGUSR2, auditd should behave in a more supportive way.
Please test again once you have 2.7.4 and let me know if you have any
problems.
-Steve
prev parent reply other threads:[~2017-03-28 2:31 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-01-25 23:06 space_left_action=exec only works once? Bond Masuda
2017-01-26 6:22 ` Steve Grubb
2017-01-26 19:38 ` Bond Masuda
2017-01-26 20:08 ` Stephen Buchanan
2017-01-26 20:14 ` Bond Masuda
2017-03-28 2:31 ` Steve Grubb [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3656144.K4VNvzPEl7@x2 \
--to=sgrubb@redhat.com \
--cc=linux-audit@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox