Hello all. Just testing different versions of audit, discovered that version 2.8.5 and 3.0.1 are changing permissions of /tmp from 1777 to 700. This is a problem as normal non-root users can't write in /tmp after starting autitd. The problem is related with the daemon, as commenting this call: start-stop-daemon -S -q -p ${PIDFILE} --exec ${DAEMON} fixes the issue. It works fine on version 2.8.2. We fixed temporaly setting proper /tmp permissions after starting the daemon: # Run audit daemon executable start-stop-daemon -S -q -p ${PIDFILE} --exec ${DAEMON} if [ $? = 0 ]; then # Load the default rules test -f /etc/audit/rules.d/audit.rules && /usr/sbin/auditctl -R /etc/audit/rules.d/audit.rules >/dev/null # Bugfix audit 2.8.5 (reported and waiting for a patch!) chmod 1777 /tmp echo "OK" else echo "FAIL" fi Could you provide a temporal patch for the daemon? Thanks!