Patch Name: PHCO_28146

Patch Description: s700_800 11.04 (VVOS) intermittent auditd fail on reboot

Creation Date: 02/11/04

Post Date:  02/11/13

Hardware Platforms - OS Releases:
	s700: 11.04
	s800: 11.04

Products: N/A

Filesets:
	VirtualVaultOS.VVOS-AUX-AUDIT,fr=B.11.04,fa=HP-UX_B.11.04_32/64,v=HP

Automatic Reboot?: Yes

Status: General Release

Critical: No

Category Tags:
	defect_repair general_release

Path Name: /hp-ux_patches/s700_800/11.X/PHCO_28146

Symptoms:
	PHCO_28146:
	auditd sometimes gets killed after starting up.This
	behaviour is seen only after many reboots on some platforms.

	PHCO_27798:
	After many reboots, auditd does not start up after reboot.
	'auditcmd -e' shows auditing is enabled,
	but 'ps -e' shows that  auditd is not running.
	This behaviour may be seen only after many reboots
	on some platforms.

	PHCO_20631:
	Reduce does not read more than the first compaction file.
	Then it just hangs.

	PHCO_20092:
	Reduce will sometimes not be able to generate any output.
	A message is displayed about invalid version numbers.

Defect Description:
	PHCO_28146:
	auditd uses the SIGALRM signal handler to sync compaction
	data to the disk. The signal handler is registered after
	the first read on the audit device. This read blocks if
	sufficient audit data ia not available. If auditd gets
	SIGALRM signal while waiting at this read, it gets
	killed.
	Resolution:
	Register the handler for SIGALRM signal before the first
	read on the audit device.

	PHCO_27798:
	PHCO_24852 introduced a new libsecurity.  Auditd needs
	to be relinked with the static library to use these
	latest libsecurity fixes.
	Resolution:
	Supply statically linked auditd which has the latest
	libsecurity changes.

	PHCO_20631:
	Alarmd was not generating a correct compaction file
	switch record.  Therefore, reduce/alarmd would never
	read the next compaction file.
	Resolution:
	Add the magic number into the compaction file switch
	record.

	PHCO_20092:
	The version numbers between the audit log file and audit
	compaction file can become out of sync.
	Resolution:
	Make sure that the version numbers in the log file and
	compaction files are the same.

Enhancement:
	No

SR:
	8606106520 8606114386 8606276327 8606285136

Patch Files:
	
	VirtualVaultOS.VVOS-AUX-AUDIT,fr=B.11.04,
		fa=HP-UX_B.11.04_32/64,v=HP:
	/tcb/bin/auditd

what(1) Output:
	
	VirtualVaultOS.VVOS-AUX-AUDIT,fr=B.11.04,
		fa=HP-UX_B.11.04_32/64,v=HP:
	/tcb/bin/auditd:
		$Revision: Hewlett-Packard ISSL Level vvos_rose42 $ 
			$Header: Hewlett-Packard ISSL Release vvos_r
			ose $ $Date: Sun Nov  3 04:34:31 EST 2002 $
		$Source: seccmd/auditd.c, cmdsaudit, vvos_rose, rose
			0290 $ $Date: 02/10/31 05:50:06 $ $Revision:
			 1.27.3.3 PATCH_11.04 (PHCO_28146) $
		$Source: lib/libsecurity/auditdb.c, libsecurity_audi
			t, vvos_rose, rose0288 $ $Date: 01/08/23 16:
			33:10 $ $Revision: 1.14.2.2 PATCH_11.04 (PHC
			O_24852) $
		$ PATCH/11.00:PHCO_24148  May 25 2001 08:04:43 $

cksum(1) Output:
	
	VirtualVaultOS.VVOS-AUX-AUDIT,fr=B.11.04,
		fa=HP-UX_B.11.04_32/64,v=HP:
	2385331509 352256 /tcb/bin/auditd

Patch Conflicts: None

Patch Dependencies: None

Hardware Dependencies: None

Other Dependencies: None

Supersedes:
	PHCO_20092 PHCO_20631 PHCO_27798

Equivalent Patches: None

Patch Package Size: 370 KBytes

Installation Instructions:
	Please review all instructions and the Hewlett-Packard
	SupportLine User Guide or your Hewlett-Packard support terms
	and conditions for precautions, scope of license,
	restrictions, and, limitation of liability and warranties,
	before installing this patch.
	------------------------------------------------------------
	1. Back up your system before installing a patch.

	2. Login as root.

	3. Copy the patch to the /tmp directory.

	4. Move to the /tmp directory and unshar the patch:

		cd /tmp
		sh PHCO_28146

	5. Run swinstall to install the patch:

		swinstall -x autoreboot=true -x patch_match_target=true \
			  -s /tmp/PHCO_28146.depot

	By default swinstall will archive the original software in 
	/var/adm/sw/save/PHCO_28146.  If you do not wish to retain a
	copy of the original software, include the patch_save_files
	option in the swinstall command above:

		-x patch_save_files=false

	WARNING: If patch_save_files is false when a patch is installed,
		 the patch cannot be deinstalled.  Please be careful
		 when using this feature.

	For future reference, the contents of the PHCO_28146.text file is 
	available in the product readme:

		swlist -l product -a readme -d @ /tmp/PHCO_28146.depot

	To put this patch on a magnetic tape and install from the
	tape drive, use the command:

		dd if=/tmp/PHCO_28146.depot of=/dev/rmt/0m bs=2k

Special Installation Instructions: None