https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=229381
Bug ID: 229381
Summary: reads to /dev/audit aren't interruptible
Product: Base System
Version: CURRENT
Hardware: Any
OS: Any
Status: New
Severity: Affects Some People
Priority: ---
Component: kern
Assignee: [email protected]
Reporter: [email protected]
auditd(8) assumes that read(2)s of /dev/audit are interruptible by signals. It
relies on these reads being interrupted by SIGCHLD, SIGTERM, and SIGHUP.
However, reads of this device aren't actually interruptible. I don't know why,
because audit_read _looks_ like it's doing the right thing.
Symptoms:
1) Sending SIGTERM to auditd doesn't kill it right away; you might send SIGTERM
and then send a trigger with auditon(2).
2) Same with SIGHUP
3) Zombie child processes don't get reaped until auditd receives a trigger sent
by auditon. This includes children created by expiring audit trails at auditd
startup.
--
You are receiving this mail because:
You are the assignee for the bug.
_______________________________________________
[email protected] mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-bugs
To unsubscribe, send any mail to "[email protected]"
