[SERVER-44956] Audit trail corrupt on Mac OSX Catalina Created: 05/Dec/19  Updated: 06/Dec/22  Resolved: 05/Dec/19

Status: Closed
Project: Core Server
Component/s: Security
Affects Version/s: 4.2.0
Fix Version/s: None

Type: Bug Priority: Major - P3
Reporter: John Page Assignee: Backlog - Security Team
Resolution: Duplicate Votes: 0
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Issue Links:
Duplicate
duplicates SERVER-43166 auditFormat BSON writes incomplete bson Closed
Assigned Teams:
Server Security
Operating System: ALL
Steps To Reproduce:

 mongod --dbpath `pwd` --setParameter auditAuthorizationSuccess=true --auditDestination file --auditFormat BSON --auditPath `pwd`/auditLog2.bson --logpath=`pwd`/mongod.log
MongoDB Enterprise > use test
switched to db test
MongoDB Enterprise > db.pets.insert({code: "D001",type: "DOG"})
WriteResult({ "nInserted" : 1 })
MongoDB Enterprise > db.pets.insert({code: "C001",type: "CAT"})
WriteResult({ "nInserted" : 1 })
MongoDB Enterprise > db.pets.insert({code: "F001",type: "FISH"})
WriteResult({ "nInserted" : 1 })
MongoDB Enterprise > use admin
switched to db admin
MongoDB Enterprise > db.shutdownServer()

 

 

Resulting BSON file in audit is 53 bytes long and not BSON - does not happen on OSX Mavericks

Participants:

 Description   

I have had two reports and seen a demonstration of audit trail corruption on OSX, MacOS catalina when writing a BSON audit trail - whilst this is a rare combination I'm concerned it may be a more systematic issue and affect other parts of the DB.

Basically the audit trail on catalina does not contain the expected, valid BSON data.



 Comments   
Comment by Mark Benvenuto [ 05/Dec/19 ]

john.page, audit to BSON was broken in 4.2.0 (SERVER-43166). It has been fixed in 4.2.1.

Comment by Carl Champain (Inactive) [ 05/Dec/19 ]

Thanks for the clarification.
I'm passing this ticket along to the Security team.

Comment by John Page [ 05/Dec/19 ]

Initial report to me implied 4.2.1 - on testing and verifying it turned out to be 4.2.0 and seemingly resolved in 4.2.1

Comment by Carl Champain (Inactive) [ 05/Dec/19 ]

Hi john.page,

Just making sure, you meant that the initial report was in 4.2.0? And the fix is in 4.2.1? 

Comment by John Page [ 05/Dec/19 ]

Appears fixed in  MDB 4.2.1 - initial report was it was in 4.2.1 

Comment by John Page [ 05/Dec/19 ]

Reported to me by nitin.katkam 

Generated at Thu Feb 08 05:07:28 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.