Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.

Bug 228122

Summary: audit has missing dep on audit-libs-python
Product: [Fedora] Fedora Reporter: Curtis Doty <curtis>
Component: auditAssignee: Steve Grubb <sgrubb>
Status: CLOSED CURRENTRELEASE QA Contact: Brian Brock <bbrock>
Severity: medium Docs Contact:
Priority: medium    
Version: rawhide   
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: 1.4.1 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2007-02-17 13:10:39 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Curtis Doty 2007-02-10 02:34:30 UTC
This appears to be same as bz#207672. Dunno why it was closed.

But by default, auditd will fail to start unless audit-libs-python package is
also installed.

Comment 1 Steve Grubb 2007-02-10 13:28:52 UTC
# rpm -q --requires audit
/bin/bash  
/bin/sh  
/bin/sh  
/bin/sh  
audit-libs = 1.4-1.fc6
chkconfig  
config(audit) = 1.4-1.fc6
coreutils  
libc.so.6  
libc.so.6(GLIBC_2.0)  
libc.so.6(GLIBC_2.1)  
libc.so.6(GLIBC_2.1.3)  
libc.so.6(GLIBC_2.2)  
libc.so.6(GLIBC_2.3)  
libc.so.6(GLIBC_2.3.4)  
libc.so.6(GLIBC_2.4)  
libpthread.so.0  
libpthread.so.0(GLIBC_2.0)  
libpthread.so.0(GLIBC_2.1)  
libpthread.so.0(GLIBC_2.2)  
libpthread.so.0(GLIBC_2.3.2)  
rpmlib(CompressedFileNames) <= 3.0.4-1
rpmlib(PayloadFilesHavePrefix) <= 4.0-1
rtld(GNU_HASH)

#ldd /sbin/auditd 
        linux-gate.so.1 =>  (0x00b77000)
        libpthread.so.0 => /lib/libpthread.so.0 (0x004cd000)
        libc.so.6 => /lib/libc.so.6 (0x009a1000)
        /lib/ld-linux.so.2 (0x00905000)

The above looks correct. The audit package is 100% C and no python. What command
does not work?

Comment 2 Curtis Doty 2007-02-10 19:13:29 UTC
# rpm -e audit-libs-python
# service auditd restart
Stopping auditd:                                           [  OK  ]
Starting auditd:                                           [FAILED]
# yum -y -d0 install audit-libs-python
# service auditd restart
Stopping auditd:                                           [  OK  ]
Starting auditd:                                           [  OK  ]

And syslog reveals it's the dispatcher:
auditd: Unable to open /sbin/audispd (No such file or directory)

Comment 3 Steve Grubb 2007-02-10 19:36:36 UTC
OK, I see what you mean now. We are replacing that event dispatcher in audit-1.5
with one written in C for higher performance. So probably the best thing to do
is just to leave it "as is" for a week and then it'll work itself out.

Comment 4 Curtis Doty 2007-02-10 19:47:34 UTC
Sounds reasonable for rawhide/f7. But I see this in fc6 too where it appears the
default auditd.conf still has dispatcher=/sbin/audispd.

Your call. I'm just being the dependency pedantisist. :-p

Comment 5 Curtis Doty 2007-02-10 20:00:31 UTC
Uh, make that Deputy Dependency Pedanticist (who can't spell). :-P

But it's a corner case. Since audit-libs-python usually gets brought in anyway
by policycoreutils. Which is not desired in my test scenario.

Comment 6 Steve Grubb 2007-02-17 13:10:39 UTC
I built audit-1.4.1-1 to resolve this issue. Its working its way through testing
and should be pushed to final early next week. A new version has been pushed out
to rawhide, too.