October 2009 - Linux-audit - Linux-Audit List Archives

by LC Bruzenak

I know I can go look at the code, however I figured I'd ask here first about the limits on the user message in both audit_log_user_message and ausearch. With audit_log_user_message the maximum length allowed appears to be around MAX_AUDIT_MESSAGE_LENGTH-100. I think it may depend on the executable name length (and other stuff auto-pushed into the string) which is why I say "around". Even when I get a successful return value (from audit_log_user_message), I don't get my string back out in "ausearch" unless it is WAY smaller - ~1K or less I think. Any ideas/thoughts? This is the latest (1.7.11-2) audit package. Thx, LCB. -- LC (Lenny) Bruzenak lenny(a)magitekltd.com

12 years, 2 months

5
17
0 / 0

AUDIT_SIGNAL_INFO

by Matthew Booth

Under what circumstances will the RHEL 4 kernel generate a message of type AUDIT_SIGNAL_INFO? My understanding is that it should be sent when a process sends a signal to the audit daemon, however I have not observed that. Any ideas? Thanks, Matt -- Matthew Booth, RHCA, RHCSS Red Hat, Global Professional Services M: +44 (0)7977 267231 GPG ID: D33C3490 GPG FPR: 3733 612D 2D05 5458 8A8A 1600 3441 EA19 D33C 3490

13 years, 5 months

3
4
0 / 0

Near Term Audit Road Map

by Steve Grubb

Hi, With the proposals sent to the list, I wanted to talk about how this might play out code-wise. With regard to the current code base, I am working on a 1.8 release. This would represent finishing the remote logging app and nothing more. The 1.8 series would become just an update series just like the 1.0.x series did. In parallel with finishing remote logging, I would release a 2.0 version. Patches applied to 1.8 would also be applied to 2.0. A 2.1 release would signify the completion of remote logging that branch. I would recommend this branch for all distributions pulling new code in. The 2.0 branch will also have a couple more changes. I want to split up the audit source code a little bit. I want to drop the system-config-audit code and let it become standalone package updated and distributed separately. I also want to drop all audispd-plugins in the 2.0 branch and have them released separately. They cause unnecessary build dependencies for the audit package. During the work for a 2.2 release, I would also like to pull the audispd program inside auditd. In the past, I tried to keep auditd lean and single purpose, but with adding remote logging and kerberos support, we already have something that is hard to analyze. So, to improve performance and decrease system load, the audit daemon will also do event dispatching. Would this proposal impact anyone in a Bad Way? Thanks, -Steve

13 years, 5 months

4
11
0 / 0

ausearch

by Pittigher, Raymond - CS

I see that the -w or --word switch was added to the ausearch but how it it used? The man pages claim: String based matches must match the whole word. But I have been trying ausearch -w failed and variation of that but only get the message ausearch -if audit.log.3 -w failed failed is an unsupported option This e-mail and any files transmitted with it may be proprietary and are intended solely for the use of the individual or entity to whom they are addressed. If you have received this e-mail in error please notify the sender. Please note that any views or opinions presented in this e-mail are solely those of the author and do not necessarily represent those of ITT Corporation. The recipient should check this e-mail and any attachments for the presence of viruses. ITT accepts no liability for any damage caused by any virus transmitted by this e-mail.

15 years, 1 month

3
2
0 / 0

auditing activity where uid==0

by Rich Whitcroft

Hi, Here's my current rule, which is working, but is producing a lot of extra log that I'd like to suppress: -a entry,always -S execve -F euid=0 I'm wondering if there's a way to limit this to only audit events that happen from a real tty, e.g. a human user. I'm getting lots of extraneous chatter from sshd, automount, and cron, all of which are from tty=(none), but I'm not sure it's possible to filter on tty... Thanks

16 years

3
3
0 / 0

audit-1.7.16 released

by Steve Grubb

Hi, I've just released a new version of the audit daemon. It can be downloaded from http://people.redhat.com/sgrubb/audit. It will also be in rawhide soon. The ChangeLog is: - If audisp-remote plugin has a queue at exit, use non-zero exit code - In auditd, tell libev to stop processing a connection when idle timeout - In auditd, tell libev to stop processing a connection when shutting down This release fixes a bug introduced in the 1.7.15 release. The main problem was that the idle timeout was not telling libev to stop processing the associated socket when it closed an idle connection. Subsequent reconnects would go into an error state and libev would immediately close the new connection. This update fixes that problem. I also applied a patch from trunk that checks the queue size on exit of audisp-remote to decide if it was successful or not. Please let me know if you run across any problems with this release. -Steve

16 years

2
8
0 / 0

Arch support changes in 2.0.4

by Steve Grubb

Hello, I am working on a 2.0.4 release. In this release I have added user space support for the ARM EABI processor. But I got to thinking that this increases the syscall lookup table even more. So, what I decided to do is make the less "main line" architectures enabled by configure options so that it can be added if needed. This means that in 2.0.4, if you wanted alpha processor support, you would run configure using "--with-alpha". To add ARM EABI support, you would use "--with- armeb". This is in svn now if anyone wanted to play with it. Now if we could just get a kernel patch in syscall_trace: http://lxr.linux.no/#linux+v2.6.31/arch/arm/kernel/ptrace.c#L844 to steer it into audit_syscall_entry.... -Steve

16 years, 1 month

1
0
0 / 0

/var/log/audit/adit.log

by Harmon, Jeffrey D

To all, Is there a way to have "/var/log/audit/audit.log" produce output in Human Readable form or is there a tool to view the log file with timestamp and username info attached to log entries?? Thanks, Jeff Harmon IT Manager / Senior Network Administrator / FSO Alion Science and Technology Advanced Modeling and Simulation Technology Operation (AMSTO) 2602 Challenger Tech Court, Suite 230 Orlando, FL 32826 Tel: (407) 737-3599 x404 Fax: (407) 737-0847 Cell: (407) 353-7238 jharmon(a)alionscience.com www.alionscience.com <http://www.alionscience.com/>

16 years, 1 month

2
1
0 / 0

Proof of concept patch, add dropping privileges to a non root user

by corentin.labbe

Hello This is a patch that add a -u parameter to auditd. This parameter permit to auditd to drop to an unprivilegied UID after initialization. Any comment will be appreciated. Cordially

16 years, 1 month

3
2
0 / 0

audit-2.0.3 released

by Steve Grubb

Hi, I've just released a new version of the audit daemon. It can be downloaded from http://people.redhat.com/sgrubb/audit. It will also be in rawhide soon. The ChangeLog is: - In auditd, tell libev to stop processing a connection when idle timeout - In auditd, tell libev to stop processing a connection when shutting down - Interpret CAPSET records in ausearch/auparse This release fixes a bug introduced in the 2.0.3 release. The main problem was that the idle timeout was not telling libev to stop processing the associated socket when it closed an idle connection. Subsequent reconnects would go into an error state and libev would immediately close the new connection. This update fixes that problem. This update also adds the ability to interpret the capability bit maps in CAPSET records. Please let me know if you run across any problems with this release. -Steve

16 years, 1 month

1
0
0 / 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Linux-audit October 2009