On a RHEL 7.2 machine, if I create a POSIX shared memory in a console session, then query its presence in
/dev/shm from an SSH session, it shows the shared memory file during the first time, but after that it gets deleted mysteriously.
Finally I've broken down the test case to the following steps:
- On box1, do
tailf /dev/shm/sampleon box1. It will be accessible.
On box2, do
ssh user@box1 "ls -l /dev/shm/"
-rw------- 1 user user 1 Aug 25 17:12 sample
- Do step 3 again, and this time I don't see the file.
On box1, tailf shows that the file has been deleted.
tail: '/dev/shm/sample' has become inaccessible: No such file or directory
I've observed is that all the files corresponding to that particular user are getting deleted from
/dev/shm, even if that is a tree of directories, containing files.
I've tried to monitor the file, strace on sshd, etc.
I have tried auditd with the following rules, but no luck:
## This file is automatically generated from /etc/audit/rules.d -D -b 1024 # monitor unlink() and rmdir() system calls. -a exit,always -S unlink -S rmdir
Can someone explain what is going wrong here?