I discussed with Steve Grubb who is the libaudit and auditd author to relax the conditions for failure on auditing. Currently the audit failure is non-fatal only in case the error return from libaudit is -EPERM and the real uid is 0. That works fine for screensavers and other non-root applications however if more fine grained capability handling is used and in containers this does not work well. We agreed that the check for real uid should be dropped and treat the -EPERM as nonfatal error as it can only happen intentionally or because of misconfiguration (for example a bug in SELinux policy). It should not be possible to trigger it on demand of attacker. This patch achieves the above. OK to commit it? diff --git a/libpam/pam_audit.c b/libpam/pam_audit.c index 24fb799..97a9a92 100644 --- a/libpam/pam_audit.c +++ b/libpam/pam_audit.c @@ -53,7 +53,7 @@ _pam_audit_writelog(pam_handle_t *pamh, int audit_fd, int type, pamh->audit_state |= PAMAUDIT_LOGGED; if (rc < 0) { - if (rc == -EPERM && getuid() != 0) + if (rc == -EPERM) return 0; if (errno != old_errno) { old_errno = errno; -- Tomas Mraz No matter how far down the wrong road you've gone, turn back. Turkish proverb (You'll never know whether the road is wrong though.)