[PATCH] selftests: netfilter: fix nft_audit.sh auditd detection

From: Jin Li

Date: Thu Sep 10 2026 - 23:59:16 EST


The auditd PID file location changed from /var/run/auditd.pid to
/run/audit/auditd.pid in newer audit-userspace versions, causing the
skip check in nft_audit.sh to fail silently.

Replace the PID file check with pgrep, which works regardless of
where the PID file is located.

Signed-off-by: Jin Li <jinli@xxxxxxxxxxxxxxxxxxx>
---
tools/testing/selftests/net/netfilter/nft_audit.sh | 11 +++--------
1 file changed, 3 insertions(+), 8 deletions(-)

diff --git a/tools/testing/selftests/net/netfilter/nft_audit.sh b/tools/testing/selftests/net/netfilter/nft_audit.sh
index 87f2b4c725aa..85cc4ce7742a 100755
--- a/tools/testing/selftests/net/netfilter/nft_audit.sh
+++ b/tools/testing/selftests/net/netfilter/nft_audit.sh
@@ -6,14 +6,9 @@
SKIP_RC=4
RC=0

-if [ -r /var/run/auditd.pid ];then
- read pid < /var/run/auditd.pid
- p=$(pgrep ^auditd$)
-
- if [ "$pid" -eq "$p" ]; then
- echo "SKIP: auditd is running"
- exit $SKIP_RC
- fi
+if pgrep -x auditd > /dev/null; then
+ echo "SKIP: auditd is running"
+ exit $SKIP_RC
fi

nft --version >/dev/null 2>&1 || {
--
2.53.0