[Bug 229381] reads to /dev/audit aren't interruptible

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=229381

            Bug ID: 229381
           Summary: reads to /dev/audit aren't interruptible
           Product: Base System
           Version: CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Some People
          Priority: ---
         Component: kern
          Assignee: bugs at FreeBSD.org
          Reporter: asomers at FreeBSD.org

auditd(8) assumes that read(2)s of /dev/audit are interruptible by signals.  It
relies on these reads being interrupted by SIGCHLD, SIGTERM, and SIGHUP. 
However, reads of this device aren't actually interruptible.  I don't know why,
because audit_read _looks_ like it's doing the right thing.

Symptoms:
1) Sending SIGTERM to auditd doesn't kill it right away; you might send SIGTERM
and then send a trigger with auditon(2).
2) Same with SIGHUP
3) Zombie child processes don't get reaped until auditd receives a trigger sent
by auditon.  This includes children created by expiring audit trails at auditd
startup.

-- 
You are receiving this mail because:
You are the assignee for the bug.