auditd daemon is changing /tmp permissions

[Steve Grubb]

Hello,

On Thursday, March 4, 2021 10:45:03 AM EST Ivan Castell wrote:
> Just testing different versions of audit, discovered that version 2.8.5 and
> 3.0.1 are changing permissions of /tmp from 1777 to 700. This is a problem
> as normal non-root users can't write in /tmp after starting autitd.
> 
> The problem is related with the daemon, as commenting this call:
> 
> start-stop-daemon -S -q -p ${PIDFILE} --exec ${DAEMON}
> 
> fixes the issue.
> 
> It works fine on version 2.8.2.
> 
> We fixed temporaly setting proper /tmp permissions after starting the
> daemon:
> 
> # Run audit daemon executable
> start-stop-daemon -S -q -p ${PIDFILE} --exec ${DAEMON}
> 
> if [ $? = 0 ]; then
> # Load the default rules
> test -f /etc/audit/rules.d/audit.rules && /usr/sbin/auditctl -R
> /etc/audit/rules.d/audit.rules >/dev/null # Bugfix audit 2.8.5 (reported
> and waiting for a patch!)
> chmod 1777 /tmp
> echo "OK"
> else
> echo "FAIL"
> fi
> 
> Could you provide a temporal patch for the daemon?

Hmm...

[audit-3.0.2]$ grep -rl start-stop-daemon *
[audit-3.0.2]$ grep -rl 'test -f /etc/audit/rules.d/audit.rules' *
[audit-3.0.2]$ 

I don't see this in the audit source code. Which file is this in?

-Steve