Bug 248025 - 'BSM conversion requested for unknown event 43115' generated by audit
Summary: 'BSM conversion requested for unknown event 43115' generated by audit
Status: Open
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: 12.1-RELEASE
Hardware: Any Any
: --- Affects Only Me
Assignee: Christian S.J. Peron
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2020-07-16 19:08 UTC by James B. Byrne
Modified: 2020-10-31 21:03 UTC (History)
4 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description James B. Byrne 2020-07-16 19:08:50 UTC
Similar to bug: 157946

System Events
=-=-=-=-=-=-=
Jul 14 10:03:45 <authpriv.notice> vhost04 sudo[37520]: username : TTY=pts/4
; PWD=/usr/home/username ; USER=root ; COMMAND=/usr/bin/su -m
Jul 14 15:00:00 vhost04 newsyslog[12472]: logfile turned over due to size>1000K
Jul 14 15:00:05 <kern.crit> vhost04 kernel: BSM conversion requested for
unknown event 43115
Jul 14 15:00:19 <kern.crit> vhost04 syslogd: last message repeated 31 times
Jul 14 15:00:20 <security.notice> vhost04 auditd[880]: renamed
Comment 1 James B. Byrne 2020-07-16 19:13:56 UTC
Seems to be related to audit itself somehow.

Jul 14 15:00:36 <security.notice> vhost04 auditd[880]: renamed
/var/audit/20200714190020.not_terminated. to
/var/audit/20200714190020.20200714190036.
Jul 14 15:00:36 <security.notice> vhost04 auditd[880]: New audit file is
/var/audit/20200714190036.not_terminated.
Jul 14 15:00:36 <security.warn> vhost04 root[15372]: audit warning: closefile
/var/audit/20200714190020.20200714190036.
Jul 14 15:00:36 <security.warn> vhost04 root[15373]: audit warning: expired
/var/audit/20200714185713.20200714185728.
Jul 14 15:00:41 <kern.crit> vhost04 kernel: BSM conversion requested for
unknown event 43115
Jul 14 15:01:06 <kern.crit> vhost04 syslogd: last message repeated 51 times
Jul 14 15:01:06 <security.notice> vhost04 auditd[880]: renamed
/var/audit/20200714190036.not_terminated. to
/var/audit/20200714190036.20200714190106.
Jul 14 15:01:06 <security.notice> vhost04 auditd[880]: New audit file is
/var/audit/20200714190106.not_terminated.
Jul 14 15:01:06 <security.warn> vhost04 root[20507]: audit warning: closefile
/var/audit/20200714190036.20200714190106.
Jul 14 15:01:06 <kern.crit> vhost04 kernel: BSM conversion requested for
unknown event 43115
Comment 2 Eirik Oeverby 2020-07-19 21:52:44 UTC
This shows up here whenever a jail is started. Is this relevant?
Comment 3 Christian S.J. Peron freebsd_committer 2020-10-31 20:28:06 UTC
This should be straightforward to track down. Thanks for reporting this
Comment 4 Christian S.J. Peron freebsd_committer 2020-10-31 20:38:06 UTC
Yeah its for jail_attach() this was fixed in current btw, but i am not sure if it was MFC'ed