rpms/audit
7
0
Fork 0
Code Issues Pull Requests Releases Activity

audit: rebase to 4.2.1

Browse Source 
Rebase from 4.0.3 to 4.2.1. The /run/audit/ migration introduced in
upstream 4.1.2 is reverted since the CentOS Stream 10 selinux-policy
has not yet been updated to allow auditd_t to manage the /run/audit/
subdirectory (tracked in RHEL-224026). Drop this patch once the
selinux-policy backport lands.

Resolves: RHEL-172047
Resolves: RHEL-102929
Resolves: RHEL-185097
Signed-off-by: Cropi <alakatos@redhat.com>
This commit is contained in:
Cropi 2026-05-04 09:55:01 +02:00
parent d0f905f3c8
commit 187dab8bd5
14 changed files with 585 additions and 640 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.gitignore vendored
View File

@ -179,3 +179,5 @@ audit-2.0.4.tar.gz
/audit-3.1.2.tar.gz
/audit-4.0.tar.gz
/v4.0.3.tar.gz
/v4.1.4.tar.gz
/v4.2.1.tar.gz

14
TTY-hostname.patch
View File

@ -1,14 +0,0 @@
diff --git a/lib/audit_logging.c b/lib/audit_logging.c
index 4da95b5e6..f63c37d2c 100644
--- a/lib/audit_logging.c
+++ b/lib/audit_logging.c
@@ -243,7 +243,8 @@ static const char *_get_hostname(const char *ttyn)
{
if (ttyn && ((strncmp(ttyn, "pts", 3) == 0) ||
(strncmp(ttyn, "tty", 3) == 0) ||
- (strncmp(ttyn, "/dev/tty", 8) == 0) )) {
+ (strncmp(ttyn, "/dev/tty", 8) == 0) ||
+ (strncmp(ttyn, "/dev/pts", 8) == 0) )) {
if (_host[0] == 0) {
gethostname(_host, HOSTLEN);
_host[HOSTLEN - 1] = 0;

65
audit.spec
View File

@ -1,26 +1,19 @@
Summary: User space tools for kernel auditing
Name: audit
Version: 4.0.3
Release: 5%{?dist}
Version: 4.2.1
Release: 1%{?dist}
License: GPL-2.0-or-later AND LGPL-2.0-or-later
URL: https://github.com/linux-audit/audit-userspace/
Source0: https://github.com/linux-audit/audit-userspace/archive/refs/tags/v%{version}.tar.gz
Source1: https://www.gnu.org/licenses/lgpl-2.1.txt
Patch0: revert-audit-run-dir.patch
Patch1: auditd-fix-16-byte-truncation-v1.patch
Patch2: auditd-fix-16-byte-truncation-v2.patch
BuildRequires: make gcc
BuildRequires: autoconf automake libtool
BuildRequires: kernel-headers >= 5.0
BuildRequires: kernel-headers >= 5.15
BuildRequires: systemd
Patch0: remote-logging-ordering-cycle.patch
Patch1: timebased-log-rotation.patch
Patch2: remove-HALT-spaceleftaction.patch
Patch3: warning-before-HALT.patch
Patch4: TTY-hostname.patch
Patch5: permtab-unsupport-syscalls-v1.patch
Patch6: permtab-unsupport-syscalls-v2.patch
Patch7: ausearch-checkpoint-race.patch
Requires: %{name}-libs%{?_isa} = %{version}-%{release}
Recommends: %{name}-rules%{?_isa} = %{version}-%{release}
Requires(post): systemd coreutils
@ -51,7 +44,7 @@ applications to use the audit framework.
Summary: Header files for libaudit
License: LGPL-2.0-or-later
Requires: %{name}-libs%{?_isa} = %{version}-%{release}
Requires: kernel-headers >= 5.0
Requires: kernel-headers >= 5.15
%description libs-devel
The audit-libs-devel package contains the header files needed for
@ -98,35 +91,27 @@ Management Facility) database, through an IBM Tivoli Directory Server
%package rules
Summary: audit rules and utilities
License: GPL-2.0-or-later
Recommends: %{name} = %{version}-%{release}
Requires(post): coreutils gawk grep
Requires: %{name}-libs%{?_isa} = %{version}-%{release}
Recommends: %{name} = %{version}-%{release}
%description rules
The audit rules package contains the rules and utilities to load audit rules.
%prep
%setup -q -n %{name}-userspace-%{version}
%patch -P 0 -p1
%patch -P 1 -p1
%patch -P 2 -p1
%patch -P 3 -p1
%patch -P 4 -p1
%patch -P 5 -p1
%patch -P 6 -p1
%patch -P 7 -p1
cp %{SOURCE1} .
%autopatch -p1
%build
autoreconf -fv --install
# Remove the ids code, its not ready
sed -i 's/ ids / /' audisp/plugins/Makefile.am
sed -i 's/ ids / /' audisp/plugins/Makefile.in
%configure --with-python=no \
--with-python3=yes \
%configure --with-python3=yes \
--enable-gssapi-krb5=yes --with-arm --with-aarch64 --with-riscv \
--with-libcap-ng=yes --without-golang --enable-zos-remote \
--enable-experimental --with-io_uring
--with-io_uring --enable-experimental --with-nftables
make CFLAGS="%{optflags}" %{?_smp_mflags}
@ -141,6 +126,7 @@ make DESTDIR=$RPM_BUILD_ROOT install
# Remove these items so they don't get picked up.
rm -f $RPM_BUILD_ROOT/%{_libdir}/libaudit.a
rm -f $RPM_BUILD_ROOT/%{_libdir}/libauparse.a
rm -f $RPM_BUILD_ROOT/%{_libdir}/libauplugin.a
find $RPM_BUILD_ROOT -name '*.la' -delete
find $RPM_BUILD_ROOT/%{_libdir}/python%{python3_version}/site-packages -name '*.a' -delete || true
@ -150,7 +136,7 @@ touch -r ./audit.spec $RPM_BUILD_ROOT/etc/libaudit.conf
touch -r ./audit.spec $RPM_BUILD_ROOT/usr/share/man/man5/libaudit.conf.5.gz
%check
#make %{?_smp_mflags} check
make %{?_smp_mflags} check
# Get rid of make files so that they don't get packaged.
rm -f rules/Makefile*
@ -214,7 +200,8 @@ fi
%{!?_licensedir:%global license %%doc}
%license lgpl-2.1.txt
%{_libdir}/libaudit.so.1*
%{_libdir}/libauparse.*
%{_libdir}/libauparse.so.0*
%{_libdir}/libauplugin.so.1*
%config(noreplace) %attr(640,root,root) /etc/libaudit.conf
%{_mandir}/man5/libaudit.conf.5.gz
@ -222,11 +209,13 @@ fi
%doc contrib/plugin
%{_libdir}/libaudit.so
%{_libdir}/libauparse.so
%{_libdir}/libauplugin.so
%{_includedir}/libaudit.h
%{_includedir}/audit_logging.h
%{_includedir}/audit-records.h
%{_includedir}/auparse.h
%{_includedir}/auparse-defs.h
%{_includedir}/auplugin.h
%{_datadir}/aclocal/audit.m4
%{_libdir}/pkgconfig/audit.pc
%{_libdir}/pkgconfig/auparse.pc
@ -247,8 +236,8 @@ fi
%attr(644,root,root) %{_mandir}/man8/aulastlog.8.gz
%attr(644,root,root) %{_mandir}/man8/ausyscall.8.gz
%attr(644,root,root) %{_mandir}/man5/auditd.conf.5.gz
%attr(644,root,root) %{_mandir}/man5/auditd-plugins.5.gz
%attr(644,root,root) %{_mandir}/man5/auditd.cron.5.gz
%attr(644,root,root) %{_mandir}/man5/auditd-plugins.5.gz
%attr(755,root,root) %{_sbindir}/auditd
%attr(755,root,root) %{_sbindir}/ausearch
%attr(755,root,root) %{_sbindir}/aureport
@ -265,7 +254,12 @@ fi
%attr(750,root,root) %{_libexecdir}/initscripts/legacy-actions/auditd/rotate
%attr(750,root,root) %{_libexecdir}/initscripts/legacy-actions/auditd/state
%attr(750,root,root) %{_libexecdir}/initscripts/legacy-actions/auditd/stop
%ghost %{_localstatedir}/run/auditd.state
%{_datadir}/bash-completion/completions/ausearch
%{_datadir}/bash-completion/completions/aureport
%attr(644,root,root) %{_datadir}/bash-completion/completions/auditctl
%{_datadir}/bash-completion/completions/augenrules
%ghost %attr(0644,root,root) %{_runstatedir}/auditd.pid
%ghost %attr(0640,root,root) %{_runstatedir}/auditd.state
%attr(-,root,-) %dir %{_var}/log/audit
%attr(750,root,root) %dir /etc/audit/plugins.d
%config(noreplace) %attr(640,root,root) /etc/audit/auditd.conf
@ -315,6 +309,15 @@ fi
%attr(750,root,root) %{_sbindir}/audispd-zos-remote
%changelog
* Mon May 04 2026 Attila Lakatos <alakatos@redhat.com> - 4.2.1-1
- Rebase to 4.2.1
- Revert /run/audit/ migration (selinux-policy not yet updated, RHEL-224026)
Resolves: RHEL-172047
- Prevent netlink congestion causing ENOBUFS errors under heavy file system activity
Resolves: RHEL-102929
- Fix auditctl -h printing spurious error message
Resolves: RHEL-185097
* Tue Jan 06 2026 Attila Lakatos <alakatos@redhat.com> - 4.0.3-5
- Fix POSTIN scriplet to not fail during upgrade
Resolves: RHEL-128464

120
auditd-fix-16-byte-truncation-v1.patch Normal file
View File

@ -0,0 +1,120 @@
From dfb513670f8950d9a5fd5d06be883e283837dfb0 Mon Sep 17 00:00:00 2001
From: Cropi <alakatos@redhat.com>
Date: Thu, 6 Aug 2026 13:42:11 +0200
Subject: [PATCH 1/2] auditd: add regression tests for V1 plugin dispatch
payload length
Add three tests for dispatch_event() covering the AUDISP_PROTOCOL_VER
path:
- test_netlink_payload_length: kernel-originated events set nlmsg_len
to the payload length only (without NLMSG_HDRLEN), so the dispatcher
must copy exactly nlmsg_len bytes.
- test_invalid_netlink_length: oversized payload lengths are rejected
before the memcpy.
- test_kernel_event_payload_not_truncated: pins the specific bug where
a 263-byte kernel event was dispatched as 247 bytes due to an
incorrect NLMSG_HDRLEN subtraction. Exercises the rep->nlh ==
&rep->msg.nlh path with a mid-range nlmsg_len value.
- test_synthetic_payload_length: locally synthesised V1 events also
use nlmsg_len directly as the payload size.
Signed-off-by: Cropi <alakatos@redhat.com>
---
src/test/auditd_dispatch_test.c | 43 +++++++++++++++++++++++++++------
1 file changed, 35 insertions(+), 8 deletions(-)
diff --git a/src/test/auditd_dispatch_test.c b/src/test/auditd_dispatch_test.c
index dfdc169f..424f544f 100644
--- a/src/test/auditd_dispatch_test.c
+++ b/src/test/auditd_dispatch_test.c
@@ -84,7 +84,11 @@ static void free_queued_event(void)
}
/*
- * test_netlink_payload_length - verify netlink headers are not copied as data
+ * test_netlink_payload_length - verify the full payload is copied as-is
+ *
+ * The kernel audit subsystem stores the payload length directly in nlmsg_len
+ * without adding NLMSG_HDRLEN, so the dispatcher must use it without
+ * subtraction.
*
* Returns: None.
*/
@@ -96,7 +100,7 @@ static void test_netlink_payload_length(void)
memset(rep.msg.data, 'a', sizeof(rep.msg.data));
rep.type = AUDIT_SYSCALL;
rep.nlh = &rep.msg.nlh;
- rep.msg.nlh.nlmsg_len = NLMSG_LENGTH(sizeof(rep.msg.data));
+ rep.msg.nlh.nlmsg_len = sizeof(rep.msg.data);
assert(dispatch_event(&rep, AUDISP_PROTOCOL_VER) == 0);
assert(queued_event != NULL);
@@ -107,7 +111,7 @@ static void test_netlink_payload_length(void)
}
/*
- * test_invalid_netlink_length - reject malformed embedded netlink lengths
+ * test_invalid_netlink_length - reject oversized payload lengths
*
* Returns: None.
*/
@@ -117,17 +121,39 @@ static void test_invalid_netlink_length(void)
memset(&rep, 0, sizeof(rep));
rep.nlh = &rep.msg.nlh;
- rep.msg.nlh.nlmsg_len = NLMSG_HDRLEN - 1;
+ rep.msg.nlh.nlmsg_len = sizeof(rep.msg.data) + 1;
assert(dispatch_event(&rep, AUDISP_PROTOCOL_VER) == -1);
assert(queued_event == NULL);
+}
- rep.msg.nlh.nlmsg_len = NLMSG_LENGTH(sizeof(rep.msg.data)) + 1;
- assert(dispatch_event(&rep, AUDISP_PROTOCOL_VER) == -1);
- assert(queued_event == NULL);
+/*
+ * test_kernel_event_payload_not_truncated - nlmsg_len used as-is for kernel events
+ *
+ * Pins the fix for the NLMSG_HDRLEN subtraction bug: a kernel-originated
+ * event must arrive at the plugin with exactly nlmsg_len bytes, not
+ * nlmsg_len minus NLMSG_HDRLEN.
+ *
+ * Returns: None.
+ */
+static void test_kernel_event_payload_not_truncated(void)
+{
+ struct audit_reply rep;
+
+ memset(&rep, 0, sizeof(rep));
+ rep.type = AUDIT_SYSCALL;
+ rep.nlh = &rep.msg.nlh;
+ rep.msg.nlh.nlmsg_len = 263;
+ memset(rep.msg.data, 'k', sizeof(rep.msg.data));
+
+ assert(dispatch_event(&rep, AUDISP_PROTOCOL_VER) == 0);
+ assert(queued_event != NULL);
+ assert(queued_event->hdr.size == 263);
+ assert(memcmp(queued_event->data, rep.msg.data, 263) == 0);
+ free_queued_event();
}
/*
- * test_synthetic_payload_length - retain auditd's local V1 length convention
+ * test_synthetic_payload_length - local V1 events use nlmsg_len directly
*
* Returns: None.
*/
@@ -150,6 +176,7 @@ int main(void)
{
test_netlink_payload_length();
test_invalid_netlink_length();
+ test_kernel_event_payload_not_truncated();
test_synthetic_payload_length();
return 0;
}
--
2.55.0

70
auditd-fix-16-byte-truncation-v2.patch Normal file
View File

@ -0,0 +1,70 @@
From 3d117ad74fda3247a29c3749e872c49187f97629 Mon Sep 17 00:00:00 2001
From: Cropi <alakatos@redhat.com>
Date: Thu, 6 Aug 2026 13:42:22 +0200
Subject: [PATCH 2/2] auditd: fix 16-byte truncation of events dispatched to
plugins
The kernel audit subsystem stores the payload length in nlmsg_len rather
than the full netlink message length (payload + NLMSG_HDRLEN). The V1
dispatch path incorrectly subtracted NLMSG_HDRLEN from nlmsg_len when
computing e->hdr.size, causing the last 16 bytes of every event to be
silently dropped before being written to the plugin pipe.
This manifests as fields at the tail of the audit record (typically
terminal= and res=) being missing from the syslog plugin output when
log_format=RAW is in use and no node name is configured (which keeps
events on the V1 protocol path). The V2 path is unaffected because it
uses rep->len, which is set correctly by replace_event_msg().
Fix the payload size to use nlmsg_len directly. The two branches of the
original if/else (rep->nlh == &rep->msg.nlh vs. not) became identical
after this correction, so collapse them into a single code path. Update
the upper bound of the sanity check to match: the old limit used
NLMSG_LENGTH() which added NLMSG_HDRLEN, making it too permissive for
the corrected size expression.
Signed-off-by: Cropi <alakatos@redhat.com>
---
src/auditd-dispatch.c | 24 ++++++++----------------
1 file changed, 8 insertions(+), 16 deletions(-)
diff --git a/src/auditd-dispatch.c b/src/auditd-dispatch.c
index 40bed7c8..1bba4f26 100644
--- a/src/auditd-dispatch.c
+++ b/src/auditd-dispatch.c
@@ -75,24 +75,16 @@ int dispatch_event(const struct audit_reply *rep, int protocol_ver)
e->hdr.type = rep->type;
if (protocol_ver == AUDISP_PROTOCOL_VER) {
- if (rep->nlh == &rep->msg.nlh) {
- if (rep->msg.nlh.nlmsg_len < NLMSG_HDRLEN ||
- rep->msg.nlh.nlmsg_len >
- NLMSG_LENGTH(sizeof(e->data))) {
- free(e);
- return -1;
- }
-
- /* audit_get_reply marks embedded netlink replies this
- * way. Netlink length includes its header, while
- * event_t contains only payload. Local V0/legacy
- * events retain a payload length here. */
- e->hdr.size = rep->msg.nlh.nlmsg_len - NLMSG_HDRLEN;
- } else if (rep->msg.nlh.nlmsg_len > sizeof(e->data)) {
+ if (rep->msg.nlh.nlmsg_len > sizeof(e->data)) {
free(e);
return -1;
- } else
- e->hdr.size = rep->msg.nlh.nlmsg_len;
+ }
+
+ /* The kernel audit subsystem stores the payload length in
+ * nlmsg_len, not the full netlink message length (i.e. it
+ * does not add NLMSG_HDRLEN). Use it directly as the event
+ * payload size. */
+ e->hdr.size = rep->msg.nlh.nlmsg_len;
memcpy(e->data, (void*)rep->msg.data, e->hdr.size);
} else if (protocol_ver == AUDISP_PROTOCOL_VER2) {
e->hdr.size = rep->len;
--
2.55.0

35
ausearch-checkpoint-race.patch
View File

@ -1,35 +0,0 @@
diff --git a/src/ausearch.c b/src/ausearch.c
index 3bf95b5a..cf77ba14 100644
--- a/src/ausearch.c
+++ b/src/ausearch.c
@@ -464,6 +464,17 @@ static int process_log_fd(void)
if ((ret != 0)||(entries->cnt == 0))
break;
+ /*
+ * If we are checkpointing, decide if we output this event.
+ * We need to do it as early as here. The chkpt_input_levent event
+ * might not match the entries, so we need to ensure that we don't
+ * skip the event that is the checkpoint event. That is the marking point
+ * from which we start outputting events. Leaving that event out will produce
+ * empty results.
+ */
+ if (checkpt_filename)
+ do_output = chkpt_output_decision(&entries->e);
+
/*
* We flush all events on the last log file being processed.
* Thus incomplete events are 'carried forward' to be
@@ -471,12 +482,6 @@ static int process_log_fd(void)
* in the next file we are about to process.
*/
if (match(entries)) {
- /*
- * If we are checkpointing, decide if we output
- * this event
- */
- if (checkpt_filename)
- do_output = chkpt_output_decision(&entries->e);
if (do_output == 1) {
found = 1;

102
permtab-unsupport-syscalls-v1.patch
View File

@ -1,102 +0,0 @@
diff --git a/lib/libaudit.c b/lib/libaudit.c
index 7a8c6d4b1..de34812f0 100644
--- a/lib/libaudit.c
+++ b/lib/libaudit.c
@@ -100,6 +100,7 @@ static struct libaudit_conf config;
static int audit_failure_parser(const char *val, int line);
static int audit_name_to_uid(const char *name, uid_t *auid);
static int audit_name_to_gid(const char *name, gid_t *gid);
+static char* filter_supported_syscalls(const char* syscalls, int machine) __attr_dealloc_free;
static const struct kw_pair keywords[] =
{
@@ -1524,6 +1525,50 @@ int _audit_parse_syscall(const char *optarg, struct audit_rule_data *rule)
return audit_rule_syscallbyname_data(rule, optarg);
}
+/*
+ * Filters unsupported syscalls from a comma-separated string based
+ * on the given architecture. Returns a new string with supported syscalls
+ * or NULL on error.
+ */
+static char* filter_supported_syscalls(const char* syscalls, int machine)
+{
+ if (syscalls == NULL) {
+ return NULL;
+ }
+
+ // Allocate memory for the filtered syscalls string
+ char* filtered_syscalls = malloc(strlen(syscalls) + 1);
+ if (filtered_syscalls == NULL) {
+ return NULL;
+ }
+ filtered_syscalls[0] = '\0'; // Initialize as empty string
+
+ // Tokenize the syscalls string and filter unsupported syscalls
+ const char* delimiter = ",";
+ char* syscalls_copy = strdup(syscalls);
+ if (syscalls_copy == NULL) {
+ free(filtered_syscalls);
+ return NULL;
+ }
+ char* token = strtok(syscalls_copy, delimiter);
+ while (token != NULL) {
+ if (audit_name_to_syscall(token, machine) != -1) {
+ strcat(filtered_syscalls, token);
+ strcat(filtered_syscalls, delimiter);
+ }
+ token = strtok(NULL, delimiter);
+ }
+ free(syscalls_copy);
+
+ // Remove the trailing delimiter, if present
+ size_t len = strlen(filtered_syscalls);
+ if (len > 0 && filtered_syscalls[len - 1] == ',') {
+ filtered_syscalls[len - 1] = '\0';
+ }
+
+ return filtered_syscalls;
+}
+
static int audit_add_perm_syscalls(int perm, struct audit_rule_data *rule)
{
// We only get here if syscall notation is being used in the rule.
@@ -1536,20 +1581,36 @@ static int audit_add_perm_syscalls(int perm, struct audit_rule_data *rule)
return 0;
}
+ const int machine = audit_elf_to_machine(_audit_elf);
const char *syscalls = audit_perm_to_name(perm);
- int rc = _audit_parse_syscall(syscalls, rule);
+ const char *syscalls_to_use;
+
+ // The permtab table is hardcoded, but some syscalls, like rename
+ // on arm64, are unavailable on certain architectures. To ensure compatibility,
+ // we must avoid creating rules with unsupported syscalls.
+ char* filtered_syscalls = filter_supported_syscalls(syscalls, machine);
+ if (filtered_syscalls == NULL) {
+ // use original syscalls in case we failed to parse - should not happen
+ syscalls_to_use = syscalls;
+ audit_msg(LOG_WARNING, "Filtering syscalls failed; using original syscalls.");
+ } else {
+ syscalls_to_use = filtered_syscalls;
+ }
+
+ int rc = _audit_parse_syscall(syscalls_to_use, rule);
switch (rc)
{
case 0:
_audit_syscalladded = 1;
break;
case -1: // Should never happen
- audit_msg(LOG_ERR, "Syscall name unknown: %s", syscalls);
+ audit_msg(LOG_ERR, "Syscall name unknown: %s", syscalls_to_use);
break;
default: // Error reported - do nothing here
break;
}
+ free(filtered_syscalls);
return rc;
}

58
permtab-unsupport-syscalls-v2.patch
View File

@ -1,58 +0,0 @@
diff --git a/lib/libaudit.c b/lib/libaudit.c
index de34812f0..61f9bd9da 100644
--- a/lib/libaudit.c
+++ b/lib/libaudit.c
@@ -1536,37 +1536,35 @@ static char* filter_supported_syscalls(const char* syscalls, int machine)
return NULL;
}
- // Allocate memory for the filtered syscalls string
- char* filtered_syscalls = malloc(strlen(syscalls) + 1);
- if (filtered_syscalls == NULL) {
- return NULL;
- }
- filtered_syscalls[0] = '\0'; // Initialize as empty string
-
- // Tokenize the syscalls string and filter unsupported syscalls
+ char buf[512] = "";
+ char* ptr = buf;
const char* delimiter = ",";
+
char* syscalls_copy = strdup(syscalls);
- if (syscalls_copy == NULL) {
- free(filtered_syscalls);
+ if (syscalls_copy == NULL)
return NULL;
- }
+
char* token = strtok(syscalls_copy, delimiter);
+ int first = 1; // Track if this is the first syscall being added
+
while (token != NULL) {
if (audit_name_to_syscall(token, machine) != -1) {
- strcat(filtered_syscalls, token);
- strcat(filtered_syscalls, delimiter);
+ if (!first)
+ *ptr++ = ',';
+ ptr = stpcpy(ptr, token);
+ first = 0;
}
token = strtok(NULL, delimiter);
}
+
free(syscalls_copy);
- // Remove the trailing delimiter, if present
- size_t len = strlen(filtered_syscalls);
- if (len > 0 && filtered_syscalls[len - 1] == ',') {
- filtered_syscalls[len - 1] = '\0';
+ // If no valid syscalls were found, return NULL
+ if (ptr == buf) {
+ return NULL;
}
- return filtered_syscalls;
+ return strdup(buf);
}
static int audit_add_perm_syscalls(int perm, struct audit_rule_data *rule)

14
remote-logging-ordering-cycle.patch
View File

@ -1,14 +0,0 @@
diff --git a/init.d/auditd.service.in b/init.d/auditd.service.in
index 173795164..853912f61 100644
--- a/init.d/auditd.service.in
+++ b/init.d/auditd.service.in
@@ -16,6 +16,9 @@ Wants=audit-rules.service
## a minimal file that overrides only the necessary lines but inherits the
## original settings in case they get updated by a distribution. Please check
## systemd documentation if it's unclear how to override settings.
+## If using remote logging, ensure that the systemd-update-utmp.service file
+## is updated to remove the After=auditd.service directive to prevent a
+## boot-time ordering cycle.
After=local-fs.target systemd-tmpfiles-setup.service
#After=network-online.target local-fs.target systemd-tmpfiles-setup.service
Before=sysinit.target shutdown.target audit-rules.service

164
remove-HALT-spaceleftaction.patch
View File

@ -1,164 +0,0 @@
diff --git a/docs/auditd.conf.5 b/docs/auditd.conf.5
index 0b785e7a3..fae6efda9 100644
--- a/docs/auditd.conf.5
+++ b/docs/auditd.conf.5
@@ -156,7 +156,7 @@ while the audit daemon is running, you should send the audit daemon SIGHUP to re
This parameter tells the system what action to take when the system has
detected that it is starting to get low on disk space.
Valid values are
-.IR ignore ", " syslog ", " rotate ", " email ", " exec ", " suspend ", " single ", and " halt .
+.IR ignore ", " syslog ", " rotate ", " email ", " exec ", " suspend ", and " single .
If set to
.IR ignore ,
the audit daemon does nothing.
@@ -173,9 +173,20 @@ as well as sending the message to syslog.
.I suspend
will cause the audit daemon to stop writing records to the disk. The daemon will still be alive. The
.I single
-option will cause the audit daemon to put the computer system in single user mode. The
+option will cause the audit daemon to put the computer system in single user mode. Except for rotate, it will perform this action just one time. The previously available
.I halt
-option will cause the audit daemon to shutdown the computer system. Except for rotate, it will perform this action just one time.
+option, which would cause the audit daemon to shut down the computer system, has been deprecated and should no longer be used. It was determined that halting the system at this stage could lead to unintended consequences and is considered a bad action if selected.
+
+Disk space notifications follow a three-stage progression. The
+.I space_left_action
+is the low water mark and serves as the first warning that disk space is running low. Halting at this stage is not recommended, as it prevents administrators from taking corrective action. The next stage,
+.I admin_space_left_action,
+indicates an emergency level where immediate action is required to free up disk space. Administrators should configure critical responses for this level. Finally, the
+.I disk_full_action
+occurs when the disk is completely full. At this stage, the system may have already halted, and preemptive measures configured in earlier stages will determine the system’s behavior.
+
+
+
.TP
.I admin_space_left
This is a numeric value in megabytes that tells the audit daemon when
diff --git a/src/auditd-config.c b/src/auditd-config.c
index b2992e647..5065e6aa6 100644
--- a/src/auditd-config.c
+++ b/src/auditd-config.c
@@ -1034,6 +1034,11 @@ static int space_action_parser(const struct nv_pair *nv, int line,
if (check_exe_name(nv->option, line))
return 1;
config->space_left_exe = strdup(nv->option);
+ } else if (failure_actions[i].option == FA_HALT) {
+ audit_msg(LOG_ERR,
+ "The HALT option in space_left_action has been deprecated"
+ " to prevent system instability from premature shutdowns.");
+ return 1;
}
config->space_left_action = failure_actions[i].option;
return 0;
@@ -1043,6 +1048,13 @@ static int space_action_parser(const struct nv_pair *nv, int line,
return 1;
}
+const char *failure_action_to_str(unsigned int action)
+{
+ if (action > FA_HALT)
+ return "unknown";
+ return failure_actions[action].name;
+}
+
// returns 0 if OK, 1 on temp error, 2 on permanent error
static int validate_email(const char *acct)
{
diff --git a/src/auditd-config.h b/src/auditd-config.h
index dae6a5086..3d7170476 100644
--- a/src/auditd-config.h
+++ b/src/auditd-config.h
@@ -114,4 +114,6 @@ int start_config_manager(struct auditd_event *e);
#endif
void free_config(struct daemon_conf *config);
+const char *failure_action_to_str(unsigned int action);
+
#endif
diff --git a/src/auditd-event.c b/src/auditd-event.c
index fb3b98be4..3a64d5aae 100644
--- a/src/auditd-event.c
+++ b/src/auditd-event.c
@@ -829,19 +829,36 @@ extern int sendmail(const char *subject, const char *content,
static void do_space_left_action(int admin)
{
int action;
+ char buffer[256];
+ const char *next_actions;
- if (admin)
+ // Select the appropriate action and generate a meaningful message
+ // explaining what happens if disk space reaches a threshold or
+ // becomes completely full.
+ if (admin) {
action = config->admin_space_left_action;
- else
+
+ snprintf(buffer, sizeof(buffer),
+ "If the disk becomes full, audit will %s.", failure_action_to_str(config->disk_full_action));
+ }
+ else {
action = config->space_left_action;
+ snprintf(buffer, sizeof(buffer),
+ "If the admin space left threshold is reached, audit will %s. "
+ "If the disk becomes full, audit will %s.",
+ failure_action_to_str(config->admin_space_left_action),
+ failure_action_to_str(config->disk_full_action));
+ }
+ next_actions = buffer;
+
switch (action)
{
case FA_IGNORE:
break;
case FA_SYSLOG:
audit_msg(LOG_ALERT,
- "Audit daemon is low on disk space for logging");
+ "Audit daemon is low on disk space for logging. %s", next_actions);
break;
case FA_ROTATE:
if (config->num_logs > 1) {
@@ -851,19 +868,24 @@ static void do_space_left_action(int admin)
}
break;
case FA_EMAIL:
+ char content[512];
+ const char *subject;
+
if (admin == 0) {
- sendmail("Audit Disk Space Alert",
- "The audit daemon is low on disk space for logging! Please take action\nto ensure no loss of service.",
- config->action_mail_acct);
- audit_msg(LOG_ALERT,
- "Audit daemon is low on disk space for logging");
+ subject = "Audit Disk Space Alert";
+ snprintf(content, sizeof(content),
+ "The audit daemon is low on disk space for logging! Please take action\n"
+ "to ensure no loss of service.\n"
+ "%s", next_actions);
} else {
- sendmail("Audit Admin Space Alert",
- "The audit daemon is very low on disk space for logging! Immediate action\nis required to ensure no loss of service.",
- config->action_mail_acct);
- audit_msg(LOG_ALERT,
- "Audit daemon is very low on disk space for logging");
+ subject = "Audit Admin Space Alert";
+ snprintf(content, sizeof(content),
+ "The audit daemon is very low on disk space for logging! Immediate action\n"
+ "is required to ensure no loss of service.\n"
+ "%s", next_actions);
}
+ sendmail(subject, content, config->action_mail_acct);
+ audit_msg(LOG_ALERT, "%s", content);
break;
case FA_EXEC:
// Close the logging file in case the script zips or
@@ -897,6 +919,7 @@ static void do_space_left_action(int admin)
stop = 1;
break;
case FA_HALT:
+ // Only available for admin
audit_msg(LOG_ALERT,
"The audit daemon is now halting the system and exiting due to low disk space");
change_runlevel(HALT);

358
revert-audit-run-dir.patch Normal file
View File

@ -0,0 +1,358 @@
From ce2d417a5c2c590625b49cd5d128f1ba5a55c57d Mon Sep 17 00:00:00 2001
From: Cropi <alakatos@redhat.com>
Date: Tue, 4 Aug 2026 12:59:19 +0200
Subject: [PATCH] audit: revert /run/audit subdir, use flat /var/run/ paths
CentOS Stream 10 selinux-policy does not yet have the two upstream commits
that allow auditd_t to create and manage the /run/audit/ subdirectory
(bbdd1f0b6, 730756543). Without those commits, auditd gets an AVC denial
on first boot when it tries to mkdir /run/audit.
Revert all runtime path references back to flat /var/run/ paths across
the entire audit ecosystem: auditd pid/state files, af_unix socket and
state, remote plugin state, statsd state report, ids plugin state and
log, PIDFile in the systemd unit, the tmpfiles.d entry, the legacy init
helper, and all man pages and docs.
Tracking: RHEL-224026
Drop this patch once the selinux-policy backport lands.
Signed-off-by: Cropi <alakatos@redhat.com>
---
README.md | 4 ++--
audisp/plugins/af_unix/af_unix.conf | 4 ++--
audisp/plugins/af_unix/audisp-af_unix.8 | 6 ++---
audisp/plugins/af_unix/audisp-af_unix.c | 4 ++--
audisp/plugins/ids/ids.c | 4 ++--
audisp/plugins/remote/audisp-remote.8 | 6 ++---
audisp/plugins/remote/audisp-remote.c | 2 +-
audisp/plugins/statsd/audisp-statsd.c | 2 +-
audit.spec | 2 +-
configure.ac | 2 --
docs/auditd-plugins.5 | 2 +-
docs/auditd.8 | 4 ++--
docs/auditd.conf.5 | 2 +-
init.d/audit-tmpfiles.conf | 1 -
init.d/auditd.service.in | 2 +-
init.d/auditd.state | 2 +-
src/auditd.c | 29 ++-----------------------
17 files changed, 24 insertions(+), 54 deletions(-)
diff --git a/README.md b/README.md
index 3b2af05f..1dc238f1 100644
--- a/README.md
+++ b/README.md
@@ -225,7 +225,7 @@ Another way to check performance is to use
```
auditctl --signal state
-cat /run/audit/auditd.state
+cat /var/run/auditd.state
audit version = 4.0.5
current time = 06/02/25 20:21:31
@@ -254,7 +254,7 @@ glibc uordblks (in use memory) is: 92 KiB, was: 90 KiB
glibc fordblks (total free space) is: 295 KiB, was: 297 KiB
```
-This command causes auditd to dump its internal metrics to /run/audit/auditd.state. This can tell you if auditd is healthy. Also, you can make auditd periodically update the state file by adjusting the report_interval setting in auditd.conf (note - only available in audit-4.0.5 and later). See the man page for details. Setting this allows for the continuous updating for metrics collection.
+This command causes auditd to dump its internal metrics to /var/run/auditd.state. This can tell you if auditd is healthy. Also, you can make auditd periodically update the state file by adjusting the report_interval setting in auditd.conf (note - only available in audit-4.0.5 and later). See the man page for details. Setting this allows for the continuous updating for metrics collection.
## AUPARSE
The auparse library is available to allow one to create custom reporting applications. The library is patterned after a dbase or foxpro database library and has the following categories of functions:
diff --git a/audisp/plugins/af_unix/af_unix.conf b/audisp/plugins/af_unix/af_unix.conf
index f07a5fc1..5bb0cbbe 100644
--- a/audisp/plugins/af_unix/af_unix.conf
+++ b/audisp/plugins/af_unix/af_unix.conf
@@ -8,7 +8,7 @@
active = no
path = /sbin/audisp-af_unix
type = always
-args = 0640 /run/audit/audispd_events string
+args = 0640 /var/run/audispd_events string
# To change the queue depth from the default of 512, append the value:
-# args = 0640 /run/audit/audispd_events string 1000
+# args = 0640 /var/run/audispd_events string 1000
format = binary
diff --git a/audisp/plugins/af_unix/audisp-af_unix.8 b/audisp/plugins/af_unix/audisp-af_unix.8
index 9d136858..e0c3d6aa 100644
--- a/audisp/plugins/af_unix/audisp-af_unix.8
+++ b/audisp/plugins/af_unix/audisp-af_unix.8
@@ -9,7 +9,7 @@ audisp-af_unix \- plugin to push audit events to an af_unix socket
.B args
line of the
.B af_unix.conf
-file expects three arguments: access mode, socket path, and output format, and optionally a fourth argument specifying the queue depth. The access mode determines the permissions for the socket and defaults to 0640. The socket path specifies where the socket will be created, with the default location being /run/audit/audispd_events. The output format determines the format in which events are delivered to the socket and supports two options: "string" and "binary". The "string" format delivers events in a human-readable form, while the "binary" format delivers events in their binary representation, which is essential for applications that need to process events in binary and reconstruct headers accurately. If the output format is not specified, the plugin defaults to the "string" format. If no queue depth is specified, it defaults to 512.
+file expects three arguments: access mode, socket path, and output format, and optionally a fourth argument specifying the queue depth. The access mode determines the permissions for the socket and defaults to 0640. The socket path specifies where the socket will be created, with the default location being /var/run/audispd_events. The output format determines the format in which events are delivered to the socket and supports two options: "string" and "binary". The "string" format delivers events in a human-readable form, while the "binary" format delivers events in their binary representation, which is essential for applications that need to process events in binary and reconstruct headers accurately. If the output format is not specified, the plugin defaults to the "string" format. If no queue depth is specified, it defaults to 512.
The
.B af_unix.conf
@@ -19,8 +19,8 @@ When the plugin is sent \fBSIGUSR1\fP, it writes a state report to \fBaf_unix.st
.SH FILES
/etc/audit/plugins/af_unix.conf
-/run/audit/audispd_events
-/run/audit/af_unix.state
+/var/run/audispd_events
+/var/run/af_unix.state
/etc/audit/auditd.conf
.SH "SEE ALSO"
.BR auditd.conf (8),
diff --git a/audisp/plugins/af_unix/audisp-af_unix.c b/audisp/plugins/af_unix/audisp-af_unix.c
index cbb19e31..84db7107 100644
--- a/audisp/plugins/af_unix/audisp-af_unix.c
+++ b/audisp/plugins/af_unix/audisp-af_unix.c
@@ -51,8 +51,8 @@
#include "audispd-pconfig.h"
#include "queue.h"
-#define DEFAULT_PATH AUDIT_RUN_DIR"/audispd_events"
-#define STATE_FILE AUDIT_RUN_DIR"/af_unix.state"
+#define DEFAULT_PATH "/var/run/audispd_events"
+#define STATE_FILE "/var/run/af_unix.state"
//#define DEBUG
/* Global Data */
diff --git a/audisp/plugins/ids/ids.c b/audisp/plugins/ids/ids.c
index a302e0c6..0b339463 100644
--- a/audisp/plugins/ids/ids.c
+++ b/audisp/plugins/ids/ids.c
@@ -56,7 +56,7 @@ volatile int hup = 0;
volatile int dump_state = 0;
static auparse_state_t *au = NULL;
#define NO_ACTIONS (!hup && !stop && !dump_state)
-#define STATE_FILE AUDIT_RUN_DIR"/ids-state"
+#define STATE_FILE "/var/run/ids-state"
#define TIMER_INTERVAL 30 // Run every 30 seconds
struct ids_conf config;
@@ -76,7 +76,7 @@ void my_printf(const char *fmt, ...)
fputc('\n', stderr);
} else if (mode == 3) {
if (l == NULL) {
- l = fopen(AUDIT_RUN_DIR"/audisp-ids.log", "w");
+ l = fopen("/var/run/audisp-ids.log", "w");
if (l == NULL) {
va_end(ap);
return;
diff --git a/audisp/plugins/remote/audisp-remote.8 b/audisp/plugins/remote/audisp-remote.8
index 0003990f..dbac50ab 100644
--- a/audisp/plugins/remote/audisp-remote.8
+++ b/audisp/plugins/remote/audisp-remote.8
@@ -14,9 +14,7 @@ If you are aggregating multiple machines, you should edit auditd.conf to set the
.TP
SIGUSR1
Causes the audisp-remote program to write a state report to
-.B remote.state
-in
-.BR /run/audit .
+.B /var/run/remote.state .
The
.IR suspend
flag tells whether or not logging has been suspended. The
@@ -37,7 +35,7 @@ Causes the audisp-remote program to resume logging if it were suspended due to a
/etc/audit/audisp-remote.conf
/etc/audit/plugins.d/au-remote.conf
/etc/audit/auditd.conf
-/run/audit/remote.state
+/var/run/remote.state
.SH "SEE ALSO"
.BR auditd.conf (8),
.BR auditd-plugins (5),
diff --git a/audisp/plugins/remote/audisp-remote.c b/audisp/plugins/remote/audisp-remote.c
index 3555c457..12933b8d 100644
--- a/audisp/plugins/remote/audisp-remote.c
+++ b/audisp/plugins/remote/audisp-remote.c
@@ -98,7 +98,7 @@ static size_t max_queued_length = 0;
/* Constants */
static const char *SPOOL_FILE = "/var/spool/audit/remote.log";
-#define STATE_FILE AUDIT_RUN_DIR"/remote.state"
+#define STATE_FILE "/var/run/remote.state"
/* Local function declarations */
static int check_message(void);
diff --git a/audisp/plugins/statsd/audisp-statsd.c b/audisp/plugins/statsd/audisp-statsd.c
index 2c1ea9e3..9f0737c6 100644
--- a/audisp/plugins/statsd/audisp-statsd.c
+++ b/audisp/plugins/statsd/audisp-statsd.c
@@ -39,7 +39,7 @@
#include "auplugin.h"
/* Global Definitions */
-#define STATE_REPORT AUDIT_RUN_DIR"/auditd.state"
+#define STATE_REPORT "/var/run/auditd.state"
#define CONFIG "/etc/audit/audisp-statsd.conf"
struct daemon_config
diff --git a/audit.spec b/audit.spec
index e653882a..5d853509 100644
--- a/audit.spec
+++ b/audit.spec
@@ -239,7 +239,7 @@ fi
%{_datadir}/bash-completion/completions/ausearch
%{_datadir}/bash-completion/completions/aureport
%{_datadir}/bash-completion/completions/augenrules
-%ghost %{_runstatedir}/%{name}/auditd.state
+%ghost %{_runstatedir}/auditd.state
%attr(-,root,-) %dir %{_var}/log/audit
%attr(750,root,root) %dir /etc/audit/plugins.d
%config(noreplace) %attr(640,root,root) /etc/audit/auditd.conf
diff --git a/configure.ac b/configure.ac
index c95015a4..d730482d 100644
--- a/configure.ac
+++ b/configure.ac
@@ -81,8 +81,6 @@ dnl If user didn't override it, prefer FHS /run over ${localstatedir}/run
AS_IF([test "x$runstatedir" = x'${localstatedir}/run'], [
runstatedir=/run
])
-AC_DEFINE_UNQUOTED([AUDIT_RUN_DIR], ["$runstatedir/audit"],
- [Directory for audit runtime state files])
AC_CHECK_DECLS([AUDIT_FEATURE_VERSION], [], [], [[#include <linux/audit.h>]])
AC_CHECK_MEMBERS([struct audit_status.feature_bitmap], [], [], [[#include <linux/audit.h>]])
AC_CHECK_DECLS([AUDIT_VERSION_BACKLOG_WAIT_TIME], [], [], [[#include <linux/audit.h>]])
diff --git a/docs/auditd-plugins.5 b/docs/auditd-plugins.5
index 455328ae..e420ee1e 100644
--- a/docs/auditd-plugins.5
+++ b/docs/auditd-plugins.5
@@ -46,7 +46,7 @@ option tells the dispatcher to completely change the event into a string suitabl
.SH NOTE
auditd has an internal queue to hold events for plugins. (See the \fIq_depth\fP setting in \fIauditd.conf\fP.) Plugins have to watch for and dequeue events as fast as possible and queue them internally if they can't be immediately processed. If the plugin is not able to dequeue records, the auditd internal queue will get filled. At any time, as root, you can run the following to check auditd's metrics:
-auditctl --signal cont ; sleep 1 ; cat /run/audit/auditd.state
+auditctl --signal cont ; sleep 1 ; cat /var/run/auditd.state
Plugins using
.BR libauplugin
diff --git a/docs/auditd.8 b/docs/auditd.8
index 67d2cf46..76e4fe2c 100644
--- a/docs/auditd.8
+++ b/docs/auditd.8
@@ -51,7 +51,7 @@ causes auditd to immediately rotate the logs. It will consult the max_log_file_a
causes auditd to attempt to resume logging and passing events to plugins. This is usually needed after logging has been suspended or the internal queue is overflowed. Either of these conditions depends on the applicable configuration settings.
.TP
.B SIGCONT
-causes auditd to dump a report of internal state to /run/audit/auditd.state.
+causes auditd to dump a report of internal state to /var/run/auditd.state.
.SH EXIT CODES
.TP
@@ -86,7 +86,7 @@ There is an error in the configuration file
.B /etc/audit/audit-stop.rules
- These rules are loaded when the audit daemon stops.
.P
-.B /run/audit/auditd.state
+.B /var/run/auditd.state
- report about internal state.
.SH NOTES
diff --git a/docs/auditd.conf.5 b/docs/auditd.conf.5
index 203aad16..b6deb192 100644
--- a/docs/auditd.conf.5
+++ b/docs/auditd.conf.5
@@ -483,7 +483,7 @@ for days, or
.B M
for months.
The default is 0 which disables preriodic reporting. The largest value is 40 days. When set, auditd will periodically generate the state report written to
-.I /run/audit/auditd.state.
+.I /var/run/auditd.state.
.SH RELOADING
Most parameters can be changed while the daemon is running by sending
.B SIGHUP
diff --git a/init.d/audit-tmpfiles.conf b/init.d/audit-tmpfiles.conf
index 3f0823a0..5512a535 100644
--- a/init.d/audit-tmpfiles.conf
+++ b/init.d/audit-tmpfiles.conf
@@ -1,2 +1 @@
-d /run/audit 0700 root root - -
d /var/log/audit 0700 root root - -
diff --git a/init.d/auditd.service.in b/init.d/auditd.service.in
index 8abc25db..766657f8 100644
--- a/init.d/auditd.service.in
+++ b/init.d/auditd.service.in
@@ -30,7 +30,7 @@ Documentation=man:auditd(8) https://github.com/linux-audit/audit-documentation
[Service]
Type=forking
-PIDFile=@runstatedir@/audit/auditd.pid
+PIDFile=@runstatedir@/auditd.pid
ExecStart=@sbindir@/auditd
Restart=on-failure
KillMode=mixed
diff --git a/init.d/auditd.state b/init.d/auditd.state
index 2534849d..c59fe5a6 100644
--- a/init.d/auditd.state
+++ b/init.d/auditd.state
@@ -6,7 +6,7 @@
test "$(id -u)" = "0" || exit 4
PATH=/sbin:/bin:/usr/bin:/usr/sbin
-state_file="/run/audit/auditd.state"
+state_file="/var/run/auditd.state"
printf "Getting auditd internal state: "
/sbin/auditctl --signal state
diff --git a/src/auditd.c b/src/auditd.c
index 727e3e88..ebfa7af3 100644
--- a/src/auditd.c
+++ b/src/auditd.c
@@ -80,8 +80,8 @@ volatile ATOMIC_INT stop = 0;
/* Local data */
static int fd = -1, pipefds[2] = {-1, -1};
static struct daemon_conf config;
-static const char *pidfile = AUDIT_RUN_DIR"/auditd.pid";
-static const char *state_file = AUDIT_RUN_DIR"/auditd.state";
+static const char *pidfile = "/var/run/auditd.pid";
+static const char *state_file = "/var/run/auditd.state";
static int init_pipe[2];
static int do_fork = 1, opt_aggregate_only = 0, config_dir_set = 0;
/*
@@ -107,7 +107,6 @@ static void report_reconfigure_failure(struct auditd_event *e);
/* Manage access to the preallocated event pool */
static struct auditd_event *alloc_pool_event(void);
int event_is_prealloc(struct auditd_event *e);
-static int make_audit_run_dir(void);
enum startup_state {startup_disable=0, startup_enable, startup_nochange,
startup_INVALID};
@@ -399,24 +398,6 @@ int send_audit_event(int type, const char *str)
return 0;
}
-
-static int make_audit_run_dir(void)
-{
- struct stat st;
-
- if (stat(AUDIT_RUN_DIR, &st) < 0) {
- if (mkdir(AUDIT_RUN_DIR, 0755) < 0) {
- audit_msg(LOG_ERR,
- "Cannot create run directory %s (%s)",
- AUDIT_RUN_DIR, strerror(errno));
- return -1;
- }
- } else if (!S_ISDIR(st.st_mode))
- return -1;
-
- return 0;
-}
-
static int write_pid_file(void)
{
int pidfd, len;
@@ -913,12 +894,6 @@ int main(int argc, char *argv[])
return 1;
}
- if (make_audit_run_dir() < 0) {
- tell_parent(FAILURE);
- free_config(&config);
- return 1;
- }
-
/* Init the event handler thread */
write_pid_file();
if (init_event(&config)) {
--
2.55.0

2
sources
View File

@ -1 +1 @@
SHA512 (v4.0.3.tar.gz) = a20d2f832632fa844764086aac98c80f7fcb120ceeaae7472248e04eec0493981e31fd59f22c3f0dbff81ccbcd132b8297812f2b4cdb87b866c59aedf3611342
SHA512 (v4.2.1.tar.gz) = 71c4ac50b471138da866a82a0fa45970cf26181962f005ae570bdbb76e7cd15b66f8ebeba75a075bf04e52b20d039f012e2bbf8b1055f44641c36897f132894d

134
timebased-log-rotation.patch
View File

@ -1,134 +0,0 @@
diff --git a/audit.spec b/audit.spec
index ee839006a..5ca742888 100644
--- a/audit.spec
+++ b/audit.spec
@@ -210,6 +210,7 @@ fi
%attr(644,root,root) %{_mandir}/man8/aulastlog.8.gz
%attr(644,root,root) %{_mandir}/man8/ausyscall.8.gz
%attr(644,root,root) %{_mandir}/man5/auditd.conf.5.gz
+%attr(644,root,root) %{_mandir}/man5/auditd.cron.5.gz
%attr(644,root,root) %{_mandir}/man5/auditd-plugins.5.gz
%attr(755,root,root) %{_sbindir}/auditd
%attr(755,root,root) %{_sbindir}/ausearch
diff --git a/docs/Makefile.am b/docs/Makefile.am
index 9db23cb3d..410ecda62 100644
--- a/docs/Makefile.am
+++ b/docs/Makefile.am
@@ -68,5 +68,6 @@ ausearch_next_event.3 ausearch_cur_event.3 ausearch_set_stop.3 \
get_auditfail_action.3 set_aumessage_mode.3 \
audispd-zos-remote.8 libaudit.conf.5 \
augenrules.8 audit_set_backlog_wait_time.3 \
-zos-remote.conf.5
+zos-remote.conf.5 \
+auditd.cron.5
diff --git a/docs/auditd.conf.5 b/docs/auditd.conf.5
index fae6efda9..d5765dd43 100644
--- a/docs/auditd.conf.5
+++ b/docs/auditd.conf.5
@@ -432,6 +432,10 @@ record type >= AUDIT_MAC_UNLBL_ALLOW && record type <= AUDIT_MAC_CALIPSO_DEL (th
for the stream being processed, the time of the event is over end_of_event_timeout seconds old.
.RE
+.SH LOG ROTATION POLICY
+
+By default, auditd uses size-based log rotation. If you prefer time-based rotation (e.g., hourly, daily, weekly, or custom schedule), refer to auditd.cron(5) for configuration details.
+
.SH FILES
.TP
.I /etc/audit/auditd.conf
@@ -440,7 +444,8 @@ Audit daemon configuration file
.SH "SEE ALSO"
.BR auditd (8),
.BR audisp\-remote.conf (5),
-.BR auditd\-plugins (5).
+.BR auditd\-plugins (5),
+.BR auditd.cron (5).
.SH AUTHOR
Steve Grubb
diff --git a/docs/auditd.cron.5 b/docs/auditd.cron.5
new file mode 100644
index 000000000..af1409823
--- /dev/null
+++ b/docs/auditd.cron.5
@@ -0,0 +1,66 @@
+.TH AUDITD.CRON "5" "Feb 2025" "Red Hat" "System Administration Utilities"
+.SH NAME
+auditd.conf \- time-based rotation of audit logs
+.SH DESCRIPTION
+By default, the audit daemon (auditd) supports size-based log rotation, where logs are rotated once they reach a specified size, as configured in
+.I /etc/audit/auditd.conf.
+This manual describes an alternative method: time-based log rotation using
+.B cron.
+Using this approach, audit logs can be rotated at specified intervals (hourly, daily, weekly or on a custom date), regardless of their size.
+
+.SH CONFIGURATION
+
+.B 1.Disable Size-Based Rotation:
+
+To enable time-based log rotation, first disable \fBauditd's\fP built-in size-based rotation by setting the following parameter in
+.I /etc/audit/auditd.conf:
+
+.RS
+max_log_file_action = ignore
+.RE
+
+.B 2. Configure Log Retention:
+
+The
+.B num_logs
+parameter determines the number of rotated log files to keep. For daily rotation, setting
+
+.RS
+num_logs = 7
+.RE
+
+ensures that logs from the last seven days are retained. However, on busy systems, audit logs may grow rapidly, potentially leading to a lack of disk space. To prevent this, ensure that the
+.B space_left_action
+parameter is configured to handle low-disk-space situations appropriately.
+
+.B 3. Apply Configuration Changes:
+
+After modifying the main auditd configuration file, reload auditd to apply the changes:
+
+.RS
+auditctl --signal reload
+.RE
+
+.B 4. Deploy the Rotation Script:
+
+Copy the provided
+.B auditd.cron
+script to the appropriate cron directory (
+.IR cron.daily
+or
+.IR cron.hourly
+or
+.IR cron.weekly
+, depending on your rotation preference). Then, ensure the file has the correct SELinux labels:
+
+.RS
+cp /usr/share/doc/audit/auditd.cron /etc/cron.daily
+.RE
+
+.SH "SEE ALSO"
+.BR auditd.conf (5),
+.BR auditd (8),
+.BR cron(8).
+
+.SH AUTHOR
+Attila Lakatos
diff --git a/init.d/auditd.cron b/init.d/auditd.cron
index 825cb227d..e692231df 100644
--- a/init.d/auditd.cron
+++ b/init.d/auditd.cron
@@ -5,7 +5,7 @@
# based on time instead of log size.
##########
-/sbin/auditctl --signal usr1
+/sbin/auditctl --signal rotate
EXITVALUE=$?
if [ $EXITVALUE != 0 ]; then
/usr/bin/logger -t auditd "ALERT auditctl exited abnormally with [$EXITVALUE] while rotating the logs"

87
warning-before-HALT.patch
View File

@ -1,87 +0,0 @@
diff --git a/common/common.c b/common/common.c
index cd15b1691..13065a0c7 100644
--- a/common/common.c
+++ b/common/common.c
@@ -25,6 +25,8 @@
#include <fcntl.h>
#include <unistd.h>
#include <stdio.h>
+#include <utmpx.h>
+#include <fcntl.h>
/*
* This function returns 1 if it is the last record in an event.
@@ -75,4 +77,36 @@ int write_to_console(const char *fmt, ...)
close(fd);
return res;
+}
+
+void wall_message(const char* format, ...)
+{
+ struct utmpx* entry;
+ char message[512];
+ va_list args;
+ int fd;
+
+ // Format the message
+ va_start(args, format);
+ vsnprintf(message, sizeof(message), format, args);
+ va_end(args);
+
+ setutxent();
+
+ // Send the message to all active users
+ while ((entry = getutxent())) {
+ // Only active users have a valid terminal
+ if (entry->ut_type == USER_PROCESS) {
+ char tty_path[128];
+ snprintf(tty_path, sizeof(tty_path), "/dev/%s", entry->ut_line);
+
+ fd = open(tty_path, O_WRONLY | O_NOCTTY);
+ if (fd != -1) {
+ dprintf(fd, "\nBroadcast message from audit daemon:\n%s\n", message);
+ close(fd);
+ }
+ }
+ }
+
+ endutxent();
}
\ No newline at end of file
diff --git a/common/common.h b/common/common.h
index 5d4b66945..61dbe7d23 100644
--- a/common/common.h
+++ b/common/common.h
@@ -57,6 +57,13 @@ int write_to_console(const char *fmt, ...)
;
#endif
+void wall_message(const char *fmt, ...)
+#ifdef __GNUC__
+ __attribute__((format(printf, 1, 2)));
+#else
+ ;
+#endif
+
AUDIT_HIDDEN_END
#endif
diff --git a/src/auditd-event.c b/src/auditd-event.c
index 3a64d5aae..a6eeb2c18 100644
--- a/src/auditd-event.c
+++ b/src/auditd-event.c
@@ -852,6 +852,13 @@ static void do_space_left_action(int admin)
}
next_actions = buffer;
+ // If space_left is reached and FA_HALT is set in any of these fields
+ // we need to inform logged in users.
+ if (config->admin_space_left_action == FA_HALT ||
+ config->disk_full_action == FA_HALT) {
+ wall_message("The audit system is low on disk space and is now halting the system for admin corrective action.");
+ }
+
switch (action)
{
case FA_IGNORE: