#1127751 aide: dailyaidecheck.service reports success after failing on syntax error

Package:
aide
Source:
aide
Description:
Advanced Intrusion Detection Environment - dynamic binary
Submitter:
Thomas Dorner
Date:
2026-02-22 11:43:02 UTC
Severity:
normal
Tags:
#1127751#5
Date:
2026-02-12 15:30:22 UTC
From:
To:
Dear Maintainer,

after adding a bad entry to my /etc/aide/aide.conf.d/80_aide_local_defs
the aide job immediately finished with:

"AIDE returned with exit code 17. Invalid configuration"
and
"ERROR: /etc/aide/aide.conf.d/80_aide_local_defs:147: syntax error"

That was correct of course.
But the systemd job did not fail, here the journald entries:

Feb 12 08:32:49 XXX systemd[1]: Starting dailyaidecheck.service - daily AIDE check...
Feb 12 08:32:50 XXX dailyaidecheck[29126]: WARN: it is not possible to use mail(1) unless aide is run as root or as non-root with added capabilities (either via systemd or via capsh). See /usr/share/doc/aide->
Feb 12 08:32:50 XXX systemd[1]: dailyaidecheck.service: Deactivated successfully.
Feb 12 08:32:50 umbra systemd[1]: Finished dailyaidecheck.service - daily AIDE check.

This made the restart after the fix a bit tricky (several systemctl
commands needed), as it already had been run "successfully" once today.

I would expect a failing service in this case.

Best regards, Thomas
#1127751#10
Date:
2026-02-20 19:47:48 UTC
From:
To:
Hi,

thanks for spotting this and for taking your time to report this.

Please try the attached patches against your installed package. This
should

- make the dailyaidecheck service fail if aide returns a failure code
- allow the dailyaidecheck.service to not be restarted automatically
  while
- allowing the dailyaidecheck.service to be restarted manually
  automatically.

I am not sure why I set the StartLimitIntervalSec to 7200, I guess that
i did that as a safety measure just in case the timer fires twice (maybe
in DST night?).

Greetings
Marc
#1127751#15
Date:
2026-02-20 19:47:48 UTC
From:
To:
Hi,

thanks for spotting this and for taking your time to report this.

Please try the attached patches against your installed package. This
should

- make the dailyaidecheck service fail if aide returns a failure code
- allow the dailyaidecheck.service to not be restarted automatically
  while
- allowing the dailyaidecheck.service to be restarted manually
  automatically.

I am not sure why I set the StartLimitIntervalSec to 7200, I guess that
i did that as a safety measure just in case the timer fires twice (maybe
in DST night?).

Greetings
Marc
#1127751#20
Date:
2026-02-22 09:57:27 UTC
From:
To:
Hi Marc,

great job, it worked exactly as expected:

I applied your patch, added an error to my configuration file and
waited for today's run.  First it failed with error:

And after fixing the error I could immediately restart it with
"systemctl start dailyaidecheck".

Thank you for fixing this and your continuous work for the Debian
community!

Best regards, Thomas
#1127751#25
Date:
2026-02-22 10:10:22 UTC
From:
To:
I will include this in the next unstable upload. At the present time, I
don't think though that it would be worth to push a stable update for
that.

Greetings
Marc
#1127751#32
Date:
2026-02-22 11:40:16 UTC
From:
To:
That's a very reasonable approach.

Best regard, Thomas