<html> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> <style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style> </head> <body dir="ltr"> <div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> Hi!<br> <br> This is a minor bug report.</div> <div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> <br> </div> <div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> Summary:</div> <div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> If /etc/audit/auditd.conf contain for example:<br> </div> <div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> <br> </div> <div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> log_file = /var/log/auditd.log</div> <div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> <br> </div> <div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> Then /sbin/auditd will chmod the system dir /var/log to 0750.</div> <div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> This is bad and should not happen unless explicitly stated in the configuration.</div> <div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> <br> </div> <div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> <br> </div> <div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> Full story:</div> <div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> I inherited a Debian machine, installed by a former co-worker of mine.</div> <div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> He had installed and configured auditd (amongst other things).</div> <div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> I now installed exim4, but it failed to start due to lack of permissions:</div> <div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> <pre class="c-mrkdwn__pre" data-stringify-type="pre" style="margin: 4px 0px; padding: 8px; font-size: 12px; line-height: 1.50001; font-variant-ligatures: none; overflow-wrap: break-word; tab-size: 4; font-family: Monaco, Menlo, Consolas, "Courier New", monospace !important; border: 1px solid var(--saf-0); border-radius: 4px; counter-reset: list-0 0 list-1 0 list-2 0 list-3 0 list-4 0 list-5 0 list-6 0 list-7 0 list-8 0 list-9 0; color: rgb(29, 28, 29); text-align: left;">Mar 17 11:14:37 foobar exim4[4251]: 2022-03-17 11:14:37 Cannot open main log file "/var/log/exim4/mainlog": Permission denied: euid=0 egid=114 Mar 17 11:14:37 foobar exim4[4251]: exim: could not open panic log - aborting: see message(s) above</pre> I see that /var/log has mode 750:</div> <div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> <pre class="c-mrkdwn__pre" data-stringify-type="pre" style="margin: 4px 0px; padding: 8px; font-size: 12px; line-height: 1.50001; font-variant-ligatures: none; overflow-wrap: break-word; tab-size: 4; font-family: Monaco, Menlo, Consolas, "Courier New", monospace !important; border: 1px solid var(--saf-0); border-radius: 4px; background-position-x: ; background-position-y: ; background-repeat: ; background-attachment: ; background-image: ; background-size: ; background-origin: ; background-clip: ; counter-reset: list-0 0 list-1 0 list-2 0 list-3 0 list-4 0 list-5 0 list-6 0 list-7 0 list-8 0 list-9 0; color: rgb(29, 28, 29); text-align: left;">ls -ld /var/log/ drwxr-x--- 17 root syslog 4096 Mar 17 10:45 /var/log/</pre> Now the question was what (re)set this permission after every reboot?<br> After hours of investigation I finally narrowed it down to auditd being the culprit.</div> <div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> It turns out that the normal path for the logfile is /var/log/audit/audit.log<br> </div> <div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> Setting mode 0750 on the subdir /var/log/audit is nice and usually wanted.</div> <div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> But if you specify <span style="font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> log_file = /var/log/auditd.log or <span style="font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> log_file = /opt/auditd.log you *don't* want the system dirs /var/log or /opt to be chmod:ed to 0750, bricking parts of the system.</span><br> <span style="font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"></span></span><br> <span style="font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"></span>Solution:</div> <div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> 1.</div> <div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> Please syslog a message if and when auditd chmod a directory!<br> Ex:</div> <div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> "auditd: chmod /var/log from 0755 to 0750"<br> That would have shorten my investigation by many hours, to see what part of the system magically reverted /var/log to 750 after every reboot.</div> <div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> <br> </div> <div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> 2.</div> <div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> Add some intelligence to the chmod section, making it only chmod the logdir if it is located in its own subdir. <br> </div> <div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> I guess that it is suficient to just check if the full path to the file is '/var/log' and if so do nothing. That would probably be the most common mistake people would do. Other cases would be resolved quickly when you see the syslog message from 1) above.<br> </div> <div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> <br> </div> <div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> 3.</div> <div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> Possibly there should also be a configuration option for this. Maybe someone wants a different mode on the subdir (like for letting splunk read the file without messing with setfacl).<br> </div> <div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> <br> </div> <div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> /Elof<br> </div> </body> </html>