[ERROR] sudo: unable to send audit message on Synology

[heseifert]

Hello,
i got this error on my docker logs.

sudo: unable to send audit message: Operation not permitted

If i do anything on the WebUI i got this error.

My Setup:

• Synology DSM 6.1.5 DS1515+
• Lastest docker-pi-hole Image

Can any help me?

[diginc]

I would start with synology + that error message unless this is very specific to my container.

have you looked at these posts? https://duckduckgo.com/?q=site%3Aforum.synology.com+Operation+not+permitted&t=ffab&ia=web

Do you use volumes and if you remove them and re-create the container does this error go away?

[jcacavias]

I'm getting a similar error message each time I try to press the enable button. Enable appears to work, but as soon as I refresh the page, the enable button is back. Otherwise, pi-hole appears to be working. Here are the errors that appear in the logs...

sudo: unable to send audit message: Unknown error -1
sudo: pam_open_session: System error | stdout
sudo: policy plugin failed session initialization

[edin0x]

Same here when I try sudo pihole -r:

root@diginc-pi-hole1:/# sudo pihole -r
sudo: unable to send audit message: Unknown error -1
sudo: pam_open_session: System error
sudo: policy plugin failed session initialization

Also having the same problems through the Web UI, where I cannot save anything. It seems like a permissions issue, but since I'm using the already built diginc pihole docker image I would expect this to work out of the box. Running this on Synology DS916+.

Any help is appreciated.

[ShagoY]

Hi, i got this error only with --net=host (the only way to see "Top Clients ?") but i can't save any change.
sudo: policy plugin failed session initialization
sudo: unable to send audit message: Unknown error -1
sudo: pam_open_session: System error

[kn0rki]

Hi folks,
same errors for me on a DS412+.

@ShagoY the --net=host works without NAT. You can add a new network and disable ip masquerading to enable the top clients.

[ShagoY]

Hi @kn0rki, i just try in docker but no result, i think i need more information, have you a guide ?

[Tearow]

Same issue.
When ever i try to add something in whitelist or add something in blacklist or any setting i receive in docker terminal.

Sudo: Unable to send audit message: Unknown error -1
Sudo: pam_open_session: System error
Sudo: policy plugin failed session initialization

did somebody solve it already. i saw already multiple issues about this but still without solution.

Using DS412+ with docker and Diginc/pi-hole:latest

[will-code-for-pizza]

Using DS 2413+ with docker and Diginc/pi-hole:latest
Same issue here.

docker logs gave me:

sudo: unable to send audit message: Unknown error -1
sudo: pam_open_session: System error
sudo: policy plugin failed session initialization

Additionally:

dnsmasq: failed to load names from /etc/pihole/black.list: No such file or directory

Status in web UI changes from Active to Unknown a few seconds after clicking "Enable".

[nopoz]

I have the same problem. Mapping the black.list to a file doesn't fix it.

[x-Felix]

same issue here. And the admin console shows status unknown.
Searched these error messages on Google, seems the issue leads to pam_limits. Not sure it is within the docker container or Synology DSM.

[R91g]

I have the same issue.
I can't change any setting in WEB UI, when I save changes nothing change, old setting still alive.

DSM 6.0.2-8451 Update 11
DS3615xs

[x-Felix]

I tried to isolate the problem whether an image issue or Synology DSM restriction.
I only have a spare raspberry pi 3b to play with. I pulled diginc/pi-hole-multiarch:debian_armhf on HypriotOS docker environment. The same issue was not discovered in that setup although version number not displayed.
Right now what I can do is to use Raspberry Pi to service Pi-Hole directly on Raspbian OS which works perfectly. I do hope this issue can be fixed soon so that I can just use one NAS.

[nopoz]

I ended up using virtual station to spin up a debian vm which I run pihole on.

[x-Felix]

@doucheymcdoucherson thanks for the suggestion, I tried virtual station but not really satisfied with the resources it consumed. I do not run an extremely powerful synology nas.
And considering NAS requires regularly software upgrade, 10 minutes DNS downtime is not acceptable even for a home network.
So I am now using a spare Raspberry Pi directly. All issue fixed.

[CrypticOne]

I have issue 286. I think they probably could be merged. I know the webinterface uses superuser commands to update the config files.

My docker image reports the following when I try to use sudo:

root@pihole:/# sudo
sudo: unable to resolve host pihole

I updated /etc/hosts to include pihole as 127.0.0.1 which fixes the first error but still sudo is broken on
this docker on Synology.

root@pihole:/# sudo date
sudo: unable to send audit message: Unknown error -1
sudo: pam_open_session: System error
sudo: policy plugin failed session initialization

[Ulisus]

So i am having the same problems with the latest build on a Synology NAS. So i tried installing the "debian_v3.2.1" branch.

Now the settings are finally saved!

The only problems here are:

• Version numbers not showing in the right bottom corner
• Opening "Query Log" produces a popup "DataTables warning: table id=all-queries - Requested unknown parameter '5' "
• I still get the sudo: unable to send audit message: Operation not permitted" in the logs.

(By the way debian_3.1.4 didn't work, because the webport couldn't be changed from 80)

[McMac]

Running into the same issue with the System error/Unknown error -1.

I managed to drill down to it:

docker exec -it pi-hole /bin/bash
root@pi-hole:/# su
su: System error
root@pi-hole:/# sudo -i
sudo: unable to send audit message: Unknown error -1
sudo: pam_open_session: System error
sudo: policy plugin failed session initialization
root@pi-hole:/#

After some hefty googling and testing this issue only seem to occur when running with --net=host not with --net=bridge. There is a thread [
https://github.com/moby/moby/issues/5899] for another container describing the same issue and the solution seems to be "Install libpam with --disable-audit option on Ubuntu 14.04"

[diginc]

@McMac Thanks for digging into this. Looking at that Docker Moby ticket, it sounds like it's an older kernel problem rather than a docker problem. Can you confirm what docker and kernel versions you have with these commands?

docker version
docker info

My oldest test system I have is 3.19 (Vivid) and I've never seen this problem, so given the newest kernel mentioned in that thread is 3.17 I'd think somewhere between those two the problem was resolved. I'd suggest looking into any upgrade options Synology has for kernel and docker versions.

[CrypticOne]

root@DiskTiger:~# docker version
Client:
Version: 17.05.0-ce
API version: 1.29
Go version: go1.8
Git commit: 9f07f0e-synology
Built: Fri May 11 13:41:13 2018
OS/Arch: linux/amd64

Server:
Version: 17.05.0-ce
API version: 1.29 (minimum version 1.12)
Go version: go1.8
Git commit: 9f07f0e-synology
Built: Fri May 11 13:41:13 2018
OS/Arch: linux/amd64
Experimental: false
root@DiskTiger:~# docker info
Containers: 11
Running: 11
Paused: 0
Stopped: 0
Images: 105
Server Version: 17.05.0-ce
Storage Driver: aufs
Root Dir: /volume1/@docker/aufs
Backing Filesystem: extfs
Dirs: 151
Dirperm1 Supported: true
Logging Driver: db
Cgroup Driver: cgroupfs
Plugins:
Volume: local
Network: bridge host macvlan null overlay
Swarm: inactive
Runtimes: runc
Default Runtime: runc
Init Binary: docker-init
containerd version: fd189da3e13a3ef3d6d9eb73c5cd4697b4536cdd (expected: 9048e5e50717ea4497b757314bad98ea3763c145)
runc version: a2d6e07aab95ff37fb63cf5dec3c40d29940194f (expected: 9c2d8d184e5da67c95d601382adf14862e4f2228)
init version: 7a83305 (expected: 949e6fa)
Security Options:
apparmor
Kernel Version: 3.10.102
Operating System:
OSType: linux
Architecture: x86_64
CPUs: 4
Total Memory: 15.67GiB
Name: DiskTiger
ID: **
Docker Root Dir: /volume1/@docker
Debug Mode (client): false
Debug Mode (server): false
Registry: https://index.docker.io/v1/
Experimental: false
Insecure Registries:
127.0.0.0/8
Live Restore Enabled: false

WARNING: No kernel memory limit support
WARNING: No cpu cfs quota support
WARNING: No cpu cfs period support

[diginc]

Yup "Kernel Version: 3.10.102" :(

Not much I can do here for this. I searched a little about what synology allows upgrades for but it depends on the the line/model.

[R91g]

I think that DSM 6.2 has Kernel 4.4
Maybe with this version Pihole works fine.

Xpenology with loader 1.03b now works with DSM 6.2-23739 update 2:
https://mega.nz/#F!ZlkHQTTb!keje3RK017OjTp3vuWb-Cw

[ituri]

I think that DSM 6.2 has Kernel 4.4

No, it doesn't. My DS916+ runs on the latest DSM 6.2-23739 Update 2 and it comes with Kernel 3.10.105.

[McMac]

When I get a moment I might attempt to merge the suggestion from the other thread with your Dockerfile by compiling "libpam with --disable-audit". Not sure about the save function but I believe to recall that when I have misconfigured network to be host vs. bridge that e.g. the values for "Pi-hole Version N/A Web Interface Version N/A FTL Version N/A" had shown properly.
To be honest, not sure what downside the "disable-audit" on PAM brings (don't see a major issue while running as a docker container). I assume, the failing PAM audit calls are preventing the subsequent tasks.
Attempting to disable audit via config file using the system-auth/password-auth
"session required pam_tty_audit.so disable=*" didn't seem to make an difference.
(As the error occurs during "sudo: pam_open_session: System error" the "session required" couldn't have worked anyways).
Looks like a recompile is left to try at this point when I get a quiet moment next week unless someone beats me to it.
Alternative option is to revert back older docker image.

[Anatharias]

So I used a brand new DSM 6.2 on a DS1513+ (never used as a Docker host before)
launched the new docker pihole/pihole v4 image
and once setup is complete

the same message appears each time I want to enable the service:

System error
sudo: unable to resolve host pihole.n8
sudo: unable to send audit message: Unknown error -1
sudo: pam_open_session: System error
sudo: policy plugin failed session initialization

EDIT: the above happens when selecting Host network, and that some of the ports are not available
I created a new Docker host with random ports, DNS is working: no more errors.

[diginc]

Glad to hear it's working @mizhgan

I think it grew so much because of the source files and the programms to compile them.

I'll be sure to add apt autoclean and search for & remove any build essentials apps to see if that helps. I made sure to delete the debs created for pam thinking that'd get most of it but ran out of time last night so just pushed a WIP branch image for testing.

#358 is available for review if you can think of any other cleanup command ideas please feel free to add a comment there.

[Azzhoe]

@diginc I can report that this version finally is working and has fixed all those problems I had! But when looking at the log, I still see the following errors, however it doesn't seem to affect anything from what I'm aware of.

sudo: unable to resolve host pihole-pihole5
sudo: unable to send audit message: Unknown error -1

[diginc]

I've deleted the temporary test synology tag and moved the fix onto the development tag. As mentioned in this comment: I split out the pam fixes into a new base image to reduce build time and proper cleanup of the image got it back in-line with the latest tag's size.

[Azzhoe]

@diginc I've just re-downloaded the latest pihole/pihole:development version and it came out to be about 345MB vs 487MB from the pihole/pihole:synology version. But now, I am experiencing all the same problems as before. I can't enable it without it returning back to the yellow status light, and I can't save any settings.

[diginc]

Hmm sorry about that, something must have gone wrong with the build. I thought the size was a little too close to latest - it should be probably ~20Mb larger

[Azzhoe]

@diginc just downloaded the development build and it's still the same 345MB.

[Azzhoe]

@diginc any idea when this the development build will be updated, it’s still showing as 345mb.

…

On Nov 1, 2018, at 10:57 AM, Adam Hill ***@***.***> wrote: Hmm sorry about that, something must have gone wrong with the build. I thought the size was a little too close to latest - it should be probably ~20Mb larger — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#243 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AkZ-eqjef_XxSUy7tKjkAk3VNVrKAVRGks5uqxoFgaJpZM4Su_3j>.

[diginc]

Not quite sure why you're getting the same error, I'm pretty sure the pam fix should've been included in what I pushed. Size being reduced is expected because I optimized it. Has anyone else tested development to confirm if it has the fix in it or not?

When you say you have the issue again do you mean just the printed errors in the log or the actual failure of functionality?

Could you test the base image?

sudo docker run -it --rm --net=host --entrypoint=bash pihole/debian-base -c 'useradd testuser; su testuser;'
then run id

[Azzhoe]

@diginc I’m getting the exact same behaviors and errors as before. Printed errors and failure as in the status circle in pinhole dashboard is Yellow, and when I enable it, it goes back to being yellow, and my settings don’t save. Here’s a screenshot of the log https://i.postimg.cc/SKj9BGw8/Screen-Shot-2018-11-03-at-8-36-12-PM.png <https://i.postimg.cc/SKj9BGw8/Screen-Shot-2018-11-03-at-8-36-12-PM.png> Can you confirm that the pihole/pihole:development is 345mb? For now I’m reverting back to the pihole/pihole:synology build (487mb), that one works perfectly. And I'm not sure what you mean by testing the base image. Where do I type those commands?

…

On Nov 3, 2018, at 8:14 PM, Adam Hill ***@***.***> wrote: Not quite sure why you're getting the same error, I'm pretty sure the pam fix should've been included in what I pushed. Size being reduced is expected because I optimized it. Has anyone else tested development to confirm if it has the fix in it or not? When you say you have the issue again do you mean just the printed errors in the log or the actual failure of functionality? Could you test the base image? sudo docker run -it --rm --net=host --entrypoint=bash pihole/debian-base -c 'useradd testuser; su testuser;' then run id — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#243 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AkZ-elYrcct5WjjwOGS3SDr7jwcXvL-eks5urj9ggaJpZM4Su_3j>.

[dschaper]

There's something up between docker hub/cloud and actual deployment. As the image shows the latest push was 3 days ago for an image of 162 MB. But a docker pull pihole/pihole:development on a fresh install of docker pulls pihole/pihole development 9a1363998a45 2 months ago 345MB

[Azzhoe]

Strange, so how can I get the latest pihole/pihole:development? So the size of the latest version should be 162MB?

[dschaper]

That 162 MB is the size of the final layer. So the actual size on disk for the end user is the base image size plus that final layer. The dockerfile is a pretty clean build so I wouldn't expect it to be more than 300MB final size on disk. What concerns me is that the history (docker history pihole/pihole:development) shows the latest modifications to be 2 months ago while it was pushed 3 days ago. The history for latest seems to be fine however.

[Azzhoe]

I see, so is there anything that I can do on my end to get the latest version? Or do I need to wait a few days and it should update?

…

On Nov 3, 2018, at 9:00 PM, Dan Schaper ***@***.***> wrote: That 162 MB is the size of the final layer. So the actual size on disk for the end user is the base image size plus that final layer. The dockerfile is a pretty clean build so I wouldn't expect it to be more than 300MB final size on disk. What concerns me is that the history (docker history pihole/pihole:development) shows the latest modifications to be 2 months ago while it was pushed 3 days ago. The history for latest seems to be fine however. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#243 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AkZ-emC1dyjSmUY7xXgN4exw4PL7NFxlks5urkpWgaJpZM4Su_3j>.

[dschaper]

I don't think there's anything to do on the user end. If I get a chance I'll try to build an image and push it to the hub or if diginc gets to it first. I don't think it's an automated build yet but we can check.

[Azzhoe]

Okay, thanks! In that case I’ll continue using the pihole/pihole:synology until the development build finally reaches the docker registry

…

On Nov 3, 2018, at 10:02 PM, Dan Schaper ***@***.***> wrote: I don't think there's anything to do on the user end. If I get a chance I'll try to build an image and push it to the hub or if diginc gets to it first. I don't think it's an automated build yet but we can check. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#243 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AkZ-ehnjjljxxApM0tcLjndZnTkBqTACks5urli0gaJpZM4Su_3j>.

[diginc]

Hmm I tried cleaning up the development tag and old manifest pointers but it seemed to refuse...This makes me wonder if it's any manifest that gets updated which has an issue.

As a work around for not being able to clean up the pointer to the old image, I just made :dev image tag instead of :development which appears to have pointed to the right images.

[McMac]

Just tried the pihole/pihole:dev by launching a new container using network host pointing at my existing config (obviously not running both in parallel - /etc/resolv.conf, /etc/pihole, /etc/dnsmasq.d) - it didn't pickup my setupVars.conf.
Needed to set the web password via pihole -a -p but then it also didn't seem to block anything and log contains several "sudo: unable to send audit message: Unknown error -1".
Also tried a new container using only resolv.conf removing other volumes with ServerIP, DNS1, DNS2 and WEB_PORT set - no response to DNS, now Unknown error -1 + unable to resolve host pihole-dev

[Azzhoe]

@diginc this one is working for me. It shows up as 290MB. Running just like it did previously. Thank you!

…

On Nov 4, 2018, at 1:26 AM, Adam Hill ***@***.***> wrote: Hmm I tried cleaning up the development tag and old manifest pointers but it seemed to refuse...This makes me wonder if it's any manifest that gets updated which has an issue. As a work around for not being able to clean up the pointer to the old image, I just made :dev image tag instead of :development which appears to have pointed to the right images. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#243 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AkZ-etumYtwH3gJLLKK5QSKYJC7wQd2Gks5urpaigaJpZM4Su_3j>.

[jtdelia]

pihole/pihole:dev worked for me as well, no more error messages and I am able to modify and save configurations, black/white lists.

[McMac]

Which one contains the latest fix for this issue? Still :dev or is it included in the latest 4.1.1?

[diginc]

They should both be fixed and good

[McMac]

Thanks @diginc. Unfortunately I seem to miss something. Kept my config since Pi-Hole 3 with the volumes and configs defined in http://tonylawrence.com/post/unix/synology/running-pihole-inside-docker/ also tried fresh setup with only basic setup taken ignoring my previous setupVars.conf.

• Still seeing "sudo: unable to send audit message: Unknown error -1" with 4.1.1 on Synology/Docker/host - is that supposed to be fixed or just not cause anymore troubles?!
• Query Log is empty despite "Show everything and record everything" being set and no exclusions set
• After original upgrade I got "DNS service is NOT running"
• Reverting back to a re-created pihole:v4.0_amd64, pointing to old volumes, pi-hole works again however Query Log still empty

Had upgraded from 4.0 to 4.1.1. with the same config with only change of network=bridge to network=host.

At least for me the docker way of keeping configs in volumes and updating binaries only isn't working. Anything I need to reset in between.

What puzzles me the most is that it seems that it's only me having issues indicating the problem being between chair and keyboard. :(

[doNmartinez]

I am running pihole in docker on my Synology's (4 atm: 2x ds1817+ and 2x 918+). Each of them is on the newest updates for DSM, Docker and Pi-Hole. After struggling around with getting pihole setup I finally managed to get it working. One of my Diskstations had Active Directory Controlle running for test purposes. If someone has a guide to run pihole on a Synology with activated AD that would be awesome.
Anyway I am getting the same Error Messages: sudo: unable to send audit message: Unknown error -1 on stdout. But the Webinterface seems to work fine.

[doNmartinez]

And dont get me wrong. I really appreciate the work you are doing. I am not complaining. I try to give you input since I really think pihole is an awesome solution for ad blocking. But atm the synology docker version is not running that smooth. And there are some essential guides missing.
For example which volume should be assigned to store settings and information during upgrade. Or how can I import a certificate for https:// with the docker image?

[DistractionRectangle]

@doNmartinez A previous comment linked to a guide for running pihole on synology, and the updated version seems rather thorough: http://tonylawrence.com/posts/unix/synology/free-your-synology-ports/

As for this issue, could you attach a bash shell to the pihole container and provide the output of: apt-get update > /dev/null && apt list --installed | grep libpam

[pralor-bot]

This issue has been mentioned on Pi-hole Userspace. There might be relevant details there:

https://discourse.pi-hole.net/t/synology-docker-error-unable-to-resolve-host-pi-hole-and-unable-to-send-audit-message-unknown-error-1/31691/2

[helmarw]

i ran into the same problem, is there a solution for it ?
installed the latest pihole docker 5.1.2 it is atm and configured it according to this howto: https://mariushosting.com/how-to-install-pi-hole-on-your-synology-nas/
sudo: unable to send audit message: Unknown error -1

and no statistics on the website