{"action":"created","issue":{"url":"https://api.github.com/repos/tailhook/vagga/issues/71","labels_url":"https://api.github.com/repos/tailhook/vagga/issues/71/labels{/name}","comments_url":"https://api.github.com/repos/tailhook/vagga/issues/71/comments","events_url":"https://api.github.com/repos/tailhook/vagga/issues/71/events","html_url":"https://github.com/tailhook/vagga/issues/71","id":109819004,"number":71,"title":"Audit logs on fresh ubuntu hosts","user":{"login":"tailhook","id":321799,"avatar_url":"https://avatars.githubusercontent.com/u/321799?v=3","gravatar_id":"","url":"https://api.github.com/users/tailhook","html_url":"https://github.com/tailhook","followers_url":"https://api.github.com/users/tailhook/followers","following_url":"https://api.github.com/users/tailhook/following{/other_user}","gists_url":"https://api.github.com/users/tailhook/gists{/gist_id}","starred_url":"https://api.github.com/users/tailhook/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tailhook/subscriptions","organizations_url":"https://api.github.com/users/tailhook/orgs","repos_url":"https://api.github.com/users/tailhook/repos","events_url":"https://api.github.com/users/tailhook/events{/privacy}","received_events_url":"https://api.github.com/users/tailhook/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/tailhook/vagga/milestones/1","html_url":"https://github.com/tailhook/vagga/milestones/0.4.0","labels_url":"https://api.github.com/repos/tailhook/vagga/milestones/1/labels","id":1278812,"number":1,"title":"0.4.0","description":null,"creator":{"login":"tailhook","id":321799,"avatar_url":"https://avatars.githubusercontent.com/u/321799?v=3","gravatar_id":"","url":"https://api.github.com/users/tailhook","html_url":"https://github.com/tailhook","followers_url":"https://api.github.com/users/tailhook/followers","following_url":"https://api.github.com/users/tailhook/following{/other_user}","gists_url":"https://api.github.com/users/tailhook/gists{/gist_id}","starred_url":"https://api.github.com/users/tailhook/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tailhook/subscriptions","organizations_url":"https://api.github.com/users/tailhook/orgs","repos_url":"https://api.github.com/users/tailhook/repos","events_url":"https://api.github.com/users/tailhook/events{/privacy}","received_events_url":"https://api.github.com/users/tailhook/received_events","type":"User","site_admin":false},"open_issues":7,"closed_issues":9,"state":"open","created_at":"2015-08-29T14:40:01Z","updated_at":"2015-10-05T15:30:08Z","due_on":null,"closed_at":null},"comments":3,"created_at":"2015-10-05T15:12:07Z","updated_at":"2015-10-05T15:48:43Z","closed_at":null,"body":"The problem similar to #52 is actually also with other commands, for example `su`. This is related to ubuntu audit log. Pam error message:\r\n```\r\n<82>Oct  5 15:11:00 su[3]: PAM audit_log_acct_message() failed: Operation not permitted\r\n<83>Oct  5 15:11:00 su[3]: pam_authenticate: System error\r\n```\r\nAnd su error looks simply like:\r\n```\r\nsu: System error\r\n```\r\n\r\nSome manual: http://linux.die.net/man/3/audit_log_acct_message\r\nSimilar issue in docker: https://github.com/docker/docker/issues/5899\r\n\r\nYou may avoid the issue by adding \"audit=0\" to the kernel command line (in grub config). Still long-term solution must be implemented."},"comment":{"url":"https://api.github.com/repos/tailhook/vagga/issues/comments/145576847","html_url":"https://github.com/tailhook/vagga/issues/71#issuecomment-145576847","issue_url":"https://api.github.com/repos/tailhook/vagga/issues/71","id":145576847,"user":{"login":"tailhook","id":321799,"avatar_url":"https://avatars.githubusercontent.com/u/321799?v=3","gravatar_id":"","url":"https://api.github.com/users/tailhook","html_url":"https://github.com/tailhook","followers_url":"https://api.github.com/users/tailhook/followers","following_url":"https://api.github.com/users/tailhook/following{/other_user}","gists_url":"https://api.github.com/users/tailhook/gists{/gist_id}","starred_url":"https://api.github.com/users/tailhook/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tailhook/subscriptions","organizations_url":"https://api.github.com/users/tailhook/orgs","repos_url":"https://api.github.com/users/tailhook/repos","events_url":"https://api.github.com/users/tailhook/events{/privacy}","received_events_url":"https://api.github.com/users/tailhook/received_events","type":"User","site_admin":false},"created_at":"2015-10-05T15:48:43Z","updated_at":"2015-10-05T15:48:43Z","body":"So rebuilding pam with disabled audit is okay (https://github.com/sequenceiq/docker-pam/blob/master/ubuntu-14.04/Dockerfile). But I believe it might be slow to do on each container build :("}}