File _service:tar_scm_kernel_repo:backport-0002-In-a... of Package audit

File _service:tar_scm_kernel_repo:backport-0002-In-auditd-close-the-logging-file-descriptor-when-log.patch of Package audit (Revision 70ce33d2a3daeb1fdcf598a05dd2563d)

Currently displaying revision 70ce33d2a3daeb1fdcf598a05dd2563d , Show latest

From 770e4f538103f8a055f46c04a9e2514f88f175c3 Mon Sep 17 00:00:00 2001
From: Steve Grubb <sgrubb@redhat.com>
Date: Mon, 1 Nov 2021 08:29:56 -0400
Subject: [PATCH 2244/2246] In auditd, close the logging file descriptor when
 logging is suspended

---
 src/auditd-event.c | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/src/auditd-event.c b/src/auditd-event.c
index 4a0a351..e88ef6e 100644
--- a/src/auditd-event.c
+++ b/src/auditd-event.c
@@ -861,6 +861,13 @@ static void do_space_left_action(int admin)
 		case FA_SUSPEND:
 			audit_msg(LOG_ALERT,
 			    "Audit daemon is suspending logging due to low disk space.");
+			// We need to close the file so that manual
+			// intervention can move or delete the file. We
+			// don't want to keep logging to a deleted file.
+			if (log_file)
+				fclose(log_file);
+			log_file = NULL;
+			log_fd = -1;
 			logging_suspended = 1;
 			break;
 		case FA_SINGLE:
@@ -909,6 +916,13 @@ static void do_disk_full_action(void)
 		case FA_SUSPEND:
 			audit_msg(LOG_ALERT,
 			    "Audit daemon is suspending logging due to no space left on logging partition.");
+			// We need to close the file so that manual
+			// intervention can move or delete the file. We
+			// don't want to keep logging to a deleted file.
+			if (log_file)
+				fclose(log_file);
+			log_file = NULL;
+			log_fd = -1;
 			logging_suspended = 1;
 			break;
 		case FA_SINGLE:
@@ -957,6 +971,13 @@ static void do_disk_error_action(const char *func, int err)
 		case FA_SUSPEND:
 			audit_msg(LOG_ALERT,
 			    "Audit daemon is suspending logging due to previously mentioned write error");
+			// We need to close the file so that manual
+			// intervention can move or delete the file. We
+			// don't want to keep logging to a deleted file.
+			if (log_file)
+				fclose(log_file);
+			log_file = NULL;
+			log_fd = -1;
 			logging_suspended = 1;
 			break;
 		case FA_SINGLE:
-- 
1.8.3.1