audit/revert-audit-run-dir.patch

From ce2d417a5c2c590625b49cd5d128f1ba5a55c57d Mon Sep 17 00:00:00 2001
From: Cropi <alakatos@redhat.com>
Date: Tue, 4 Aug 2026 12:59:19 +0200
Subject: [PATCH] audit: revert /run/audit subdir, use flat /var/run/ paths

CentOS Stream 10 selinux-policy does not yet have the two upstream commits
that allow auditd_t to create and manage the /run/audit/ subdirectory
(bbdd1f0b6, 730756543). Without those commits, auditd gets an AVC denial
on first boot when it tries to mkdir /run/audit.

Revert all runtime path references back to flat /var/run/ paths across
the entire audit ecosystem: auditd pid/state files, af_unix socket and
state, remote plugin state, statsd state report, ids plugin state and
log, PIDFile in the systemd unit, the tmpfiles.d entry, the legacy init
helper, and all man pages and docs.

Tracking: RHEL-224026
Drop this patch once the selinux-policy backport lands.

Signed-off-by: Cropi <alakatos@redhat.com>
---
 README.md                               |  4 ++--
 audisp/plugins/af_unix/af_unix.conf     |  4 ++--
 audisp/plugins/af_unix/audisp-af_unix.8 |  6 ++---
 audisp/plugins/af_unix/audisp-af_unix.c |  4 ++--
 audisp/plugins/ids/ids.c                |  4 ++--
 audisp/plugins/remote/audisp-remote.8   |  6 ++---
 audisp/plugins/remote/audisp-remote.c   |  2 +-
 audisp/plugins/statsd/audisp-statsd.c   |  2 +-
 audit.spec                              |  2 +-
 configure.ac                            |  2 --
 docs/auditd-plugins.5                   |  2 +-
 docs/auditd.8                           |  4 ++--
 docs/auditd.conf.5                      |  2 +-
 init.d/audit-tmpfiles.conf              |  1 -
 init.d/auditd.service.in                |  2 +-
 init.d/auditd.state                     |  2 +-
 src/auditd.c                            | 29 ++-----------------------
 17 files changed, 24 insertions(+), 54 deletions(-)

diff --git a/README.md b/README.md
index 3b2af05f..1dc238f1 100644
--- a/README.md
+++ b/README.md
@@ -225,7 +225,7 @@ Another way to check performance is to use
 
 ```
 auditctl --signal state
-cat /run/audit/auditd.state
+cat /var/run/auditd.state
 
 audit version = 4.0.5
 current time = 06/02/25 20:21:31
@@ -254,7 +254,7 @@ glibc uordblks (in use memory) is: 92 KiB, was: 90 KiB
 glibc fordblks (total free space) is: 295 KiB, was: 297 KiB
 ```
 
-This command causes auditd to dump its internal metrics to /run/audit/auditd.state. This can tell you if auditd is healthy. Also, you can make auditd periodically update the state file by adjusting the report_interval setting in auditd.conf (note - only available in audit-4.0.5 and later). See the man page for details. Setting this allows for the continuous updating for metrics collection.
+This command causes auditd to dump its internal metrics to /var/run/auditd.state. This can tell you if auditd is healthy. Also, you can make auditd periodically update the state file by adjusting the report_interval setting in auditd.conf (note - only available in audit-4.0.5 and later). See the man page for details. Setting this allows for the continuous updating for metrics collection.
 
 ## AUPARSE
 The auparse library is available to allow one to create custom reporting applications. The library is patterned after a dbase or foxpro database library and has the following categories of functions:
diff --git a/audisp/plugins/af_unix/af_unix.conf b/audisp/plugins/af_unix/af_unix.conf
index f07a5fc1..5bb0cbbe 100644
--- a/audisp/plugins/af_unix/af_unix.conf
+++ b/audisp/plugins/af_unix/af_unix.conf
@@ -8,7 +8,7 @@
 active = no
 path = /sbin/audisp-af_unix
 type = always
-args = 0640 /run/audit/audispd_events string
+args = 0640 /var/run/audispd_events string
 # To change the queue depth from the default of 512, append the value:
-# args = 0640 /run/audit/audispd_events string 1000
+# args = 0640 /var/run/audispd_events string 1000
 format = binary
diff --git a/audisp/plugins/af_unix/audisp-af_unix.8 b/audisp/plugins/af_unix/audisp-af_unix.8
index 9d136858..e0c3d6aa 100644
--- a/audisp/plugins/af_unix/audisp-af_unix.8
+++ b/audisp/plugins/af_unix/audisp-af_unix.8
@@ -9,7 +9,7 @@ audisp-af_unix \- plugin to push audit events to an af_unix socket
 .B args
 line of the 
 .B af_unix.conf
-file expects three arguments: access mode, socket path, and output format, and optionally a fourth argument specifying the queue depth. The access mode determines the permissions for the socket and defaults to 0640. The socket path specifies where the socket will be created, with the default location being /run/audit/audispd_events. The output format determines the format in which events are delivered to the socket and supports two options: "string" and "binary". The "string" format delivers events in a human-readable form, while the "binary" format delivers events in their binary representation, which is essential for applications that need to process events in binary and reconstruct headers accurately. If the output format is not specified, the plugin defaults to the "string" format. If no queue depth is specified, it defaults to 512.
+file expects three arguments: access mode, socket path, and output format, and optionally a fourth argument specifying the queue depth. The access mode determines the permissions for the socket and defaults to 0640. The socket path specifies where the socket will be created, with the default location being /var/run/audispd_events. The output format determines the format in which events are delivered to the socket and supports two options: "string" and "binary". The "string" format delivers events in a human-readable form, while the "binary" format delivers events in their binary representation, which is essential for applications that need to process events in binary and reconstruct headers accurately. If the output format is not specified, the plugin defaults to the "string" format. If no queue depth is specified, it defaults to 512.
 
 The
 .B af_unix.conf
@@ -19,8 +19,8 @@ When the plugin is sent \fBSIGUSR1\fP, it writes a state report to \fBaf_unix.st
 
 .SH FILES
 /etc/audit/plugins/af_unix.conf
-/run/audit/audispd_events
-/run/audit/af_unix.state
+/var/run/audispd_events
+/var/run/af_unix.state
 /etc/audit/auditd.conf
 .SH "SEE ALSO"
 .BR auditd.conf (8),
diff --git a/audisp/plugins/af_unix/audisp-af_unix.c b/audisp/plugins/af_unix/audisp-af_unix.c
index cbb19e31..84db7107 100644
--- a/audisp/plugins/af_unix/audisp-af_unix.c
+++ b/audisp/plugins/af_unix/audisp-af_unix.c
@@ -51,8 +51,8 @@
 #include "audispd-pconfig.h"
 #include "queue.h"
 
-#define DEFAULT_PATH AUDIT_RUN_DIR"/audispd_events"
-#define STATE_FILE AUDIT_RUN_DIR"/af_unix.state"
+#define DEFAULT_PATH "/var/run/audispd_events"
+#define STATE_FILE "/var/run/af_unix.state"
 //#define DEBUG
 
 /* Global Data */
diff --git a/audisp/plugins/ids/ids.c b/audisp/plugins/ids/ids.c
index a302e0c6..0b339463 100644
--- a/audisp/plugins/ids/ids.c
+++ b/audisp/plugins/ids/ids.c
@@ -56,7 +56,7 @@ volatile int hup = 0;
 volatile int dump_state = 0;
 static auparse_state_t *au = NULL;
 #define NO_ACTIONS (!hup && !stop && !dump_state)
-#define STATE_FILE AUDIT_RUN_DIR"/ids-state"
+#define STATE_FILE "/var/run/ids-state"
 #define TIMER_INTERVAL 30	// Run every 30 seconds
 struct ids_conf config;
 
@@ -76,7 +76,7 @@ void my_printf(const char *fmt, ...)
 		fputc('\n', stderr);
 	} else if (mode == 3) {
 		if (l == NULL) {
-			l = fopen(AUDIT_RUN_DIR"/audisp-ids.log", "w");
+			l = fopen("/var/run/audisp-ids.log", "w");
 			if (l == NULL) {
 				va_end(ap);
 				return;
diff --git a/audisp/plugins/remote/audisp-remote.8 b/audisp/plugins/remote/audisp-remote.8
index 0003990f..dbac50ab 100644
--- a/audisp/plugins/remote/audisp-remote.8
+++ b/audisp/plugins/remote/audisp-remote.8
@@ -14,9 +14,7 @@ If you are aggregating multiple machines, you should edit auditd.conf to set the
 .TP
 SIGUSR1
 Causes the audisp-remote program to write a state report to
-.B remote.state
-in
-.BR /run/audit .
+.B /var/run/remote.state .
 The
 .IR suspend
 flag tells whether or not logging has been suspended. The
@@ -37,7 +35,7 @@ Causes the audisp-remote program to resume logging if it were suspended due to a
 /etc/audit/audisp-remote.conf
 /etc/audit/plugins.d/au-remote.conf
 /etc/audit/auditd.conf
-/run/audit/remote.state
+/var/run/remote.state
 .SH "SEE ALSO"
 .BR auditd.conf (8),
 .BR auditd-plugins (5),
diff --git a/audisp/plugins/remote/audisp-remote.c b/audisp/plugins/remote/audisp-remote.c
index 3555c457..12933b8d 100644
--- a/audisp/plugins/remote/audisp-remote.c
+++ b/audisp/plugins/remote/audisp-remote.c
@@ -98,7 +98,7 @@ static size_t max_queued_length = 0;
 
 /* Constants */
 static const char *SPOOL_FILE = "/var/spool/audit/remote.log";
-#define STATE_FILE AUDIT_RUN_DIR"/remote.state"
+#define STATE_FILE "/var/run/remote.state"
 
 /* Local function declarations */
 static int check_message(void);
diff --git a/audisp/plugins/statsd/audisp-statsd.c b/audisp/plugins/statsd/audisp-statsd.c
index 2c1ea9e3..9f0737c6 100644
--- a/audisp/plugins/statsd/audisp-statsd.c
+++ b/audisp/plugins/statsd/audisp-statsd.c
@@ -39,7 +39,7 @@
 #include "auplugin.h"
 
 /* Global Definitions */
-#define STATE_REPORT AUDIT_RUN_DIR"/auditd.state"
+#define STATE_REPORT "/var/run/auditd.state"
 #define CONFIG "/etc/audit/audisp-statsd.conf"
 
 struct daemon_config
diff --git a/audit.spec b/audit.spec
index e653882a..5d853509 100644
--- a/audit.spec
+++ b/audit.spec
@@ -239,7 +239,7 @@ fi
 %{_datadir}/bash-completion/completions/ausearch
 %{_datadir}/bash-completion/completions/aureport
 %{_datadir}/bash-completion/completions/augenrules
-%ghost %{_runstatedir}/%{name}/auditd.state
+%ghost %{_runstatedir}/auditd.state
 %attr(-,root,-) %dir %{_var}/log/audit
 %attr(750,root,root) %dir /etc/audit/plugins.d
 %config(noreplace) %attr(640,root,root) /etc/audit/auditd.conf
diff --git a/configure.ac b/configure.ac
index c95015a4..d730482d 100644
--- a/configure.ac
+++ b/configure.ac
@@ -81,8 +81,6 @@ dnl If user didn't override it, prefer FHS /run over ${localstatedir}/run
 AS_IF([test "x$runstatedir" = x'${localstatedir}/run'], [
   runstatedir=/run
 ])
-AC_DEFINE_UNQUOTED([AUDIT_RUN_DIR], ["$runstatedir/audit"],
-       [Directory for audit runtime state files])
 AC_CHECK_DECLS([AUDIT_FEATURE_VERSION], [], [], [[#include <linux/audit.h>]])
 AC_CHECK_MEMBERS([struct audit_status.feature_bitmap], [], [], [[#include <linux/audit.h>]])
 AC_CHECK_DECLS([AUDIT_VERSION_BACKLOG_WAIT_TIME], [], [], [[#include <linux/audit.h>]])
diff --git a/docs/auditd-plugins.5 b/docs/auditd-plugins.5
index 455328ae..e420ee1e 100644
--- a/docs/auditd-plugins.5
+++ b/docs/auditd-plugins.5
@@ -46,7 +46,7 @@ option tells the dispatcher to completely change the event into a string suitabl
 .SH NOTE
 auditd has an internal queue to hold events for plugins. (See the \fIq_depth\fP setting in \fIauditd.conf\fP.) Plugins have to watch for and dequeue events as fast as possible and queue them internally if they can't be immediately processed. If the plugin is not able to dequeue records, the auditd internal queue will get filled. At any time, as root, you can run the following to check auditd's metrics:
 
-auditctl --signal cont ; sleep 1 ; cat /run/audit/auditd.state
+auditctl --signal cont ; sleep 1 ; cat /var/run/auditd.state
 
 Plugins using
 .BR libauplugin
diff --git a/docs/auditd.8 b/docs/auditd.8
index 67d2cf46..76e4fe2c 100644
--- a/docs/auditd.8
+++ b/docs/auditd.8
@@ -51,7 +51,7 @@ causes auditd to immediately rotate the logs. It will consult the max_log_file_a
 causes auditd to attempt to resume logging and passing events to plugins. This is usually needed after logging has been suspended or the internal queue is overflowed. Either of these conditions depends on the applicable configuration settings.
 .TP
 .B SIGCONT
-causes auditd to dump a report of internal state to /run/audit/auditd.state.
+causes auditd to dump a report of internal state to /var/run/auditd.state.
 
 .SH EXIT CODES
 .TP
@@ -86,7 +86,7 @@ There is an error in the configuration file
 .B /etc/audit/audit-stop.rules
 - These rules are loaded when the audit daemon stops.
 .P
-.B /run/audit/auditd.state
+.B /var/run/auditd.state
 - report about internal state.
 
 .SH NOTES
diff --git a/docs/auditd.conf.5 b/docs/auditd.conf.5
index 203aad16..b6deb192 100644
--- a/docs/auditd.conf.5
+++ b/docs/auditd.conf.5
@@ -483,7 +483,7 @@ for days, or
 .B M
 for months.
 The default is 0 which disables preriodic reporting. The largest value is 40 days. When set, auditd will periodically generate the state report written to
-.I /run/audit/auditd.state.
+.I /var/run/auditd.state.
 .SH RELOADING
 Most parameters can be changed while the daemon is running by sending
 .B SIGHUP
diff --git a/init.d/audit-tmpfiles.conf b/init.d/audit-tmpfiles.conf
index 3f0823a0..5512a535 100644
--- a/init.d/audit-tmpfiles.conf
+++ b/init.d/audit-tmpfiles.conf
@@ -1,2 +1 @@
-d /run/audit 0700 root root - -
 d /var/log/audit 0700 root root - -
diff --git a/init.d/auditd.service.in b/init.d/auditd.service.in
index 8abc25db..766657f8 100644
--- a/init.d/auditd.service.in
+++ b/init.d/auditd.service.in
@@ -30,7 +30,7 @@ Documentation=man:auditd(8) https://github.com/linux-audit/audit-documentation
 
 [Service]
 Type=forking
-PIDFile=@runstatedir@/audit/auditd.pid
+PIDFile=@runstatedir@/auditd.pid
 ExecStart=@sbindir@/auditd
 Restart=on-failure
 KillMode=mixed
diff --git a/init.d/auditd.state b/init.d/auditd.state
index 2534849d..c59fe5a6 100644
--- a/init.d/auditd.state
+++ b/init.d/auditd.state
@@ -6,7 +6,7 @@
 test "$(id -u)" = "0"  ||  exit 4
 
 PATH=/sbin:/bin:/usr/bin:/usr/sbin
-state_file="/run/audit/auditd.state"
+state_file="/var/run/auditd.state"
 
 printf "Getting auditd internal state: "
 /sbin/auditctl --signal state
diff --git a/src/auditd.c b/src/auditd.c
index 727e3e88..ebfa7af3 100644
--- a/src/auditd.c
+++ b/src/auditd.c
@@ -80,8 +80,8 @@ volatile ATOMIC_INT stop = 0;
 /* Local data */
 static int fd = -1, pipefds[2] = {-1, -1};
 static struct daemon_conf config;
-static const char *pidfile = AUDIT_RUN_DIR"/auditd.pid";
-static const char *state_file = AUDIT_RUN_DIR"/auditd.state";
+static const char *pidfile = "/var/run/auditd.pid";
+static const char *state_file = "/var/run/auditd.state";
 static int init_pipe[2];
 static int do_fork = 1, opt_aggregate_only = 0, config_dir_set = 0;
 /*
@@ -107,7 +107,6 @@ static void report_reconfigure_failure(struct auditd_event *e);
 /* Manage access to the preallocated event pool */
 static struct auditd_event *alloc_pool_event(void);
 int event_is_prealloc(struct auditd_event *e);
-static int make_audit_run_dir(void);
 
 enum startup_state {startup_disable=0, startup_enable, startup_nochange,
 	startup_INVALID};
@@ -399,24 +398,6 @@ int send_audit_event(int type, const char *str)
 	return 0;
 }
 
-
-static int make_audit_run_dir(void)
-{
-	struct stat st;
-
-	if (stat(AUDIT_RUN_DIR, &st) < 0) {
-		if (mkdir(AUDIT_RUN_DIR, 0755) < 0) {
-			audit_msg(LOG_ERR,
-				"Cannot create run directory %s (%s)",
-				AUDIT_RUN_DIR, strerror(errno));
-			return -1;
-		}
-	} else if (!S_ISDIR(st.st_mode))
-		return -1;
-
-	return 0;
-}
-
 static int write_pid_file(void)
 {
 	int pidfd, len;
@@ -913,12 +894,6 @@ int main(int argc, char *argv[])
 		return 1;
 	}
 
-	if (make_audit_run_dir() < 0) {
-		tell_parent(FAILURE);
-		free_config(&config);
-		return 1;
-	}
-
 	/* Init the event handler thread */
 	write_pid_file();
 	if (init_event(&config)) {
-- 
2.55.0