AIDE is unable to open / even when running as root (Freebsd-15)

amity88 · 2026-02-22T06:57:42+0000

AIDE doesn't work correctly on my new install and I can't figure out what's wrong. I've tried with a working config and I've also tried with the default config that comes with it. In both cases, it looks unable to parse the root directory. This is super strange because I'm running aide --init as root.

This is the error that I get. Note that the aide database only has a single entry?

Code:

# aide --init -c /usr/local/etc/aide.conf
WARNING: failed to open directory '/' for reading: stat fields changed:  (skipping recursion, disabling attrs requiring read permissions: e2fsattrs)
WARNING: failed to get default ACL for directory '/': No such file or directory (disabling acl attribute)
Start timestamp: 2026-02-22 12:19:15 +0530 (AIDE 0.19.2)
AIDE successfully initialized database.
New AIDE database written to /var/db/aide/databases/aide.db.new

Number of entries:      1

---------------------------------------------------
The attributes of the (uncompressed) database(s):
---------------------------------------------------

/var/db/aide/databases/aide.db.new
 SHA256    : jsmcpShiaev6+qHqo/kHLRO+sO1ZWIHe
             Zrih956AV0w=
 SHA512    : FqxGNHUUtHDI7lhR6W2av1XPUqPeymbj
             qYji1dmwAtm//EOFIxYc0uBL9psUD50Q
             JZaqQ2GMqg+/ZRIPonBCtg==
 STRIBOG256: AaGpgn9Gwbc0s2iSOvzs/fHmFqjyuwsw
             bCn4OmvfSUs=
 STRIBOG512: ttyR8Sjtw81BBTdkPliaqforxSa0jPK6
             hrenpamdA521sAu4JLv0m5mcvh8ETF6G
             7ECm3Hx601Z5JyT2U2Ij4A==
 SHA512/256: w2j6SSEkKdvNSyrgrH5r+wKI8adRTEPn
             7cgDjc+eOwM=
 SHA3-256  : Pf1481X8m5HFUOdvhCiIipUEZKQjAz+Z
             nz+Xh5gqJSM=
 SHA3-512  : RCAdPj7UqI3J6cXAJdMWLZPEVqumDj7g
             QMAMETuxDNVixbnUovI66sSjf4pBvw7x
             Ou2h1YnSOs1q1WxRrnUo4A==

atax1a · 2026-02-22T17:52:13+0000

that is truly bizarre. try running it under ktrace and use kdump and see if that helps at least localize the issue?

ralphbsz · 2026-02-22T18:11:05+0000

The two error messages (stat fields changed, and unable to get ACL) sound like it isn't fully debugged on FreeBSD. Which is funny, because it claims to fully support FreeBSD (as well as MacOS and OpenBSD, which means it is not just Linux-specific).

Could it be that AIDE doesn't know about the ACL format on ZFS? Or could it be that you have some securelevel turned on making operations like stat() on "/" impossible?

Agree with tracing the system calls, and comparing them to the source code.

amity88 · 2026-02-22T19:27:17+0000

I'll try tracing the system calls to see if there's anything interesting. So far ktrace and kdump didn't yield anything interesting (to me) but let me also paste it down below.

Funny thing is that AIDE had worked for me on FreeBSD on other systems. The only major difference on this system is that I'm using jails. The AIDE is still being run from the main host thought. Not from within a jail.

kdump snippet

Code:

54648 aide     RET   write 150/0x96
 54648 aide     CALL  mmap(0x80057e000,0x201000,0x3<PROT_READ|PROT_WRITE>,0x400<MAP_STACK>,0xffffffff,0)
 54648 aide     RET   mmap 35043201024/0x828bcd000
 54648 aide     CALL  mprotect(0x828bcd000,0x1000,0<PROT_NONE>)
 54648 aide     RET   mprotect 0
 54648 aide     CALL  thr_new(0x82097fe10,0x68)
 54648 aide     STRU  thr param { start=0x822282bd0 arg=0x1e00f3249010 stack_base=0x828bce000 stack_size=0x200000 tls_base=0x1e00f32293b0 tls_size=0x18 child_tidp=0x1e00f3249010 parent_tidp=0x1e00f3249010 flags=0x6<THR_SYSTEM_SCOPE|THR_C_RUNTIME> rtp=0x0 }
 54648 aide     RET   thr_new 0
 54648 aide     CALL  _umtx_op(0x1e00f3249010,0x2<UMTX_OP_WAIT>,0x1a2df,0,0)
 54648 aide     RET   thr_new 0
 54648 aide     CALL  sigfastblock(0x1,0x1e00f3249048)
 54648 aide     RET   sigfastblock 0
 54648 aide     CALL  exterrctl(0x1,0,0x1e00f3249688)
 54648 aide     RET   exterrctl 0
 54648 aide     CALL  sigprocmask(SIG_BLOCK,0x828dcdf20,0)
 54648 aide     RET   sigprocmask 0
 54648 aide     CALL  openat(AT_FDCWD,0x1e00f3611198,0x400100<O_RDONLY|O_NOFOLLOW|O_PATH>)
 54648 aide     NAMI  "/"
 54648 aide     RET   openat 4
 54648 aide     CALL  fstat(0x4,0x828dcde60)
 54648 aide     STRU  struct stat {dev=1262939592122554501, ino=34, mode=040755, nlink=21, uid=0, gid=0, rdev=18446744073709551615, atime=1767570469, mtime=1771739852.440037000, ctime=1771739852.440037000, birthtime=1764301904, size=24, blksize=4096, blocks=17, flags=0x800 }
 54648 aide     RET   fstat 0
 54648 aide     CALL  mma
 54648 aide     NAMI  "/"
 54648 aide     RET   openat 5
 54648 aide     CALL  fstat(0x5,0x828dcdbd0)
 54648 aide     STRU  struct stat {dev=1262939592122554501, ino=34, mode=040755, nlink=21, uid=0, gid=0, rdev=18446744073709551615, atime=1767570469, mtime=1771739852.440037000, ctime=1771739852.440037000, birthtime=1764301904, size=24, blksize=4096, blocks=17, flags=0x800 }
 54648 aide     RET   fstat 0
 54648 aide     CALL  close(0x5)
 54648 aide     RET   close 0
 54648 aide     CALL  write(0x2,0x20bf34,0x4)
 54648 aide     GIO   fd 2 wrote 4 bytes
       0x0000 1b5b 324b                                                                                            |.[2K|

 54648 aide     RET   write 4
 54648 aide     CALL  write(0x2,0x828dcd360,0x69)
 54648 aide     GIO   fd 2 wrote 105 bytes
       0x0000 1b5b 313b 3333 6d57 4152 4e49 4e47 1b5b 306d 3a20 6661 696c 6564 2074 6f20 6f70 656e 2064 6972 6563  |.[1;33mWARNING.[0m: failed to open direc|
       0x0028 746f 7279 2027 2f27 2066 6f72 2072 6561 6469 6e67 3a20 7374 6174 2066 6965 6c64 7320 6368 616e 6765  |tory '/' for reading: stat fields change|
       0x0050 643a 2020 2873 6b69 7070 696e 6720 7265 6375 7273 696f 6e29 0a                                       |d:  (skipping recursion).|

 54648 aide     RET   write 105/0x69
 54648 aide     CALL  close(0x4)
 54648 aide     RET   close 0
 54648 aide     CALL  madvise(0x1e00f4400000,0x4000,MADV_FREE)
 54648 aide     RET   madvise 0
 54648 aide     CALL  thr_exit(0x1e00f3249010)

atax1a · 2026-02-22T19:36:16+0000

huh. what's sysctl kern.securelevel say?

amity88 · 2026-02-22T19:49:50+0000

atax1a said:
huh. what's sysctl kern.securelevel say?

Code:

# sysctl kern.securelevel
kern.securelevel: -1

atax1a · 2026-02-22T19:52:16+0000

bizarre, because to us it looks like it successfully opens and stats... and then just gives up.

what does ls -dl /; stat -x / say?

ralphbsz · 2026-02-22T20:22:16+0000

And in the trace I nowhere see it reading the ACL, yet it complains about the ACL. I think it's time to read the source code.

amity88 · 2026-02-22T20:26:28+0000

atax1a said:
bizarre, because to us it looks like it successfully opens and stats... and then just gives up.

what does ls -dl /; stat -x / say?

Yup, I can't think of any reason why AIDE running as root can't access /. This is the first time I've got this error on AIDE on any system.

This is the output of the commands:

Code:

# ls -dl /; stat -x /
drwxr-xr-x  21 root wheel 24 Feb 23 01:21 /
  File: "/"
  Size: 24           FileType: Directory
  Mode: (0755/drwxr-xr-x)         Uid: (    0/    root)  Gid: (    0/   wheel)
Device: 294051032,557645957   Inode: 34    Links: 21
Access: Mon Jan  5 05:17:49 2026
Modify: Mon Feb 23 01:21:30 2026
Change: Mon Feb 23 01:21:30 2026
 Birth: Fri Nov 28 09:21:44 2025

SirDice · 2026-02-23T10:09:58+0000

Scan causes ACL Warning per directory db entry on FreeBSD · Issue #214 · aide/aide

Running aide --check it seems that each a number of scanned directories is causing ACL warnings like the ones below WARNING: failed to get default ACL for directory '/usr/share/calendar': No such f...

github.com

AIDE is unable to open / even when running as root (Freebsd-15)

Administrator