Uploaded image for project: 'RHEL Testing'
  1. RHEL Testing
  2. RHELTEST-2401

rhel-10.0: Sanity/audit-testsuite: ausearch exit 256 with kernel message suppression in FIPS

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Undefined Undefined
    • None
    • False
    • Hide

      None

      Show
      None
    • False
    • None
    • rhel-se-kernel

        Failure Pattern:
        - Test: special-projects/tests/audit Sanity/audit-testsuite (task208174677
        - All 3 retry attempts failed with different subtests:
          - Attempt 1: exec_name/test (5/29 subtests failed)
          - Attempt 2: exec_name/test + time_change/test (14/203 subtests failed)
          - Attempt 3: user_msg/test (2/2 subtests failed)
        - All failures show ausearch exit code 256 (no audit records found)
        - Non-deterministic: different subtests fail across attempts, indicating timing/race condition

        Kernel-level audit message suppression in FIPS mode causing test synchronization failures.

        dmesg.log shows:

        [13726.460258] kauditd_printk_skb: 12 callbacks suppressed

        Audit sequence gap: 2401 → 2558 = 157 events dropped by kernel

        Despite userspace showing no rate limiting (rate_limit=0, lost=0 in auditd status), the kernel is silently dropping audit messages. This breaks the test synchronization mechanism where tests inject auditctl m syncmarker$key and poll with ausearch -k $key.

              rhn-support-gsierohu Gonzalo Siero Humet
              rhn-support-gsierohu Gonzalo Siero Humet
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated: