Date: Thu, 28 Jun 2018 04:16:14 +0000 From: bugzilla-noreply@freebsd.org To: bugs@FreeBSD.org Subject: [Bug 229381] reads to /dev/audit aren't interruptible Message-ID: <bug-229381-227@https.bugs.freebsd.org/bugzilla/>
next in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=229381 Bug ID: 229381 Summary: reads to /dev/audit aren't interruptible Product: Base System Version: CURRENT Hardware: Any OS: Any Status: New Severity: Affects Some People Priority: --- Component: kern Assignee: bugs@FreeBSD.org Reporter: asomers@FreeBSD.org auditd(8) assumes that read(2)s of /dev/audit are interruptible by signals. It relies on these reads being interrupted by SIGCHLD, SIGTERM, and SIGHUP. However, reads of this device aren't actually interruptible. I don't know why, because audit_read _looks_ like it's doing the right thing. Symptoms: 1) Sending SIGTERM to auditd doesn't kill it right away; you might send SIGTERM and then send a trigger with auditon(2). 2) Same with SIGHUP 3) Zombie child processes don't get reaped until auditd receives a trigger sent by auditon. This includes children created by expiring audit trails at auditd startup. -- You are receiving this mail because: You are the assignee for the bug.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-229381-227>