From mboxrd@z Thu Jan 1 00:00:00 1970 From: Fmy Oen Subject: Re: missing user authentication events. Date: Tue, 29 Nov 2011 12:24:32 +0000 (UTC) Message-ID: References: <4BAB7E7A.1070606@activedg.com> <201003251209.32751.sgrubb@redhat.com> <4BABAD2A.2020309@activedg.com> <201003251511.33968.sgrubb@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from mx1.redhat.com (ext-mx13.extmail.prod.ext.phx2.redhat.com [10.5.110.18]) by int-mx02.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id pATFRHKs016129 for ; Tue, 29 Nov 2011 10:27:17 -0500 Received: from lo.gmane.org (lo.gmane.org [80.91.229.12]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id pATFRFUH006649 for ; Tue, 29 Nov 2011 10:27:16 -0500 Received: from list by lo.gmane.org with local (Exim 4.69) (envelope-from ) id 1RVPaS-0007Yh-M9 for linux-audit@redhat.com; Tue, 29 Nov 2011 16:27:12 +0100 Received: from 173.22.150.178.triolan.net ([173.22.150.178.triolan.net]) by main.gmane.org with esmtp (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Tue, 29 Nov 2011 16:27:12 +0100 Received: from fmyoen by 173.22.150.178.triolan.net with local (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Tue, 29 Nov 2011 16:27:12 +0100 List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com Hi, I have the same problem Robert Harris talking about. CentOS: > ldd /lib/libpam.so.0 linux-gate.so.1 => (0x00680000) libdl.so.2 => /lib/libdl.so.2 (0x00601000) libaudit.so.0 => /lib/libaudit.so.0 (0x0069a000) libc.so.6 => /lib/libc.so.6 (0x004a6000) /lib/ld-linux.so.2 (0x00482000) > strings /lib/libpam.so.0 | grep audit_open audit_open audit_open() failed: %m Debian: > ldd /lib/libpam.so.0 linux-gate.so.1 => (0xb7733000) libdl.so.2 => /lib/i686/cmov/libdl.so.2 (0xb771c000) libcrypt.so.1 => /lib/i686/cmov/libcrypt.so.1 (0xb76ea000) libc.so.6 => /lib/i686/cmov/libc.so.6 (0xb75a3000) /lib/ld-linux.so.2 (0xb7734000) > strings /lib/libpam.so.0 | grep audit_open > I managed to recompile login package but I'm having problems with compilation of libpam0g (/lib/libpam.so.0 containing package): > sudo dpkg-buildpackage -rfakeroot -b ... /bin/bash ../../libtool --tag=CC --mode=link gcc -I../../libpam/include -I../../libpamc/include -I../../libpam_misc/include -g -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -O2 -W -Wall -Wbad-function-cast -Wcast-align -Wcast-qual -Wmissing-declarations -Wmissing-prototypes -Wpointer-arith -Wreturn-type -Wstrict-prototypes -Wwrite-strings -Winline -Wshadow -no-undefined -avoid-version -module -Wl,--version-script=./../modules.map -Wl,-z,defs -Wl,--as-needed -Wl,-O1 -o pam_selinux.la -rpath /lib/security pam_selinux.lo -L../../libpam -lpam -lselinux -lcrypt libtool: link: gcc -shared .libs/pam_selinux.o -Wl,-rpath -Wl,/home/fmyoen/tmp/1/pam-1.1.1/libpam/.libs -L/home/fmyoen/tmp/1/pam-1.1.1/libpam /home/fmyoen/tmp/1/pam-1.1.1/libpam/.libs/libpam.so -lselinux -lcrypt -Wl,--version-script=./../modules.map -Wl,-z -Wl,defs -Wl,--as-needed -Wl,-O1 -Wl,-soname -Wl,pam_selinux.so -o .libs/pam_selinux.so .libs/pam_selinux.o: In function `send_audit_message': /home/fmyoen/tmp/1/pam-1.1.1/modules/pam_selinux/pam_selinux.c:87: undefined reference to `audit_open' /home/fmyoen/tmp/1/pam-1.1.1/modules/pam_selinux/pam_selinux.c:112: undefined reference to `audit_log_user_message' collect2: ld returned 1 exit status make[4]: *** [pam_selinux.la] Error 1 make[4]: Leaving directory `/home/fmyoen/tmp/1/pam-1.1.1/modules/pam_selinux' make[3]: *** [all-recursive] Error 1 make[3]: Leaving directory `/home/fmyoen/tmp/1/pam-1.1.1/modules' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/home/fmyoen/tmp/1/pam-1.1.1' make[1]: *** [all] Error 2 make[1]: Leaving directory `/home/fmyoen/tmp/1/pam-1.1.1' dh_auto_build: make -j1 returned exit code 2 make: *** [build] Error 2 dpkg-buildpackage: error: debian/rules build gave error exit status 2 Any ideas what should I do? For me it looks like some packages still need to be recompiled. How can I trace it?