April 2010 - Linux-audit - Linux-Audit List Archives

by LC Bruzenak

I know I can go look at the code, however I figured I'd ask here first about the limits on the user message in both audit_log_user_message and ausearch. With audit_log_user_message the maximum length allowed appears to be around MAX_AUDIT_MESSAGE_LENGTH-100. I think it may depend on the executable name length (and other stuff auto-pushed into the string) which is why I say "around". Even when I get a successful return value (from audit_log_user_message), I don't get my string back out in "ausearch" unless it is WAY smaller - ~1K or less I think. Any ideas/thoughts? This is the latest (1.7.11-2) audit package. Thx, LCB. -- LC (Lenny) Bruzenak lenny(a)magitekltd.com

12 years, 6 months

5
17
0 / 0

AUDIT_SIGNAL_INFO

by Matthew Booth

Under what circumstances will the RHEL 4 kernel generate a message of type AUDIT_SIGNAL_INFO? My understanding is that it should be sent when a process sends a signal to the audit daemon, however I have not observed that. Any ideas? Thanks, Matt -- Matthew Booth, RHCA, RHCSS Red Hat, Global Professional Services M: +44 (0)7977 267231 GPG ID: D33C3490 GPG FPR: 3733 612D 2D05 5458 8A8A 1600 3441 EA19 D33C 3490

13 years, 10 months

3
4
0 / 0

Near Term Audit Road Map

by Steve Grubb

Hi, With the proposals sent to the list, I wanted to talk about how this might play out code-wise. With regard to the current code base, I am working on a 1.8 release. This would represent finishing the remote logging app and nothing more. The 1.8 series would become just an update series just like the 1.0.x series did. In parallel with finishing remote logging, I would release a 2.0 version. Patches applied to 1.8 would also be applied to 2.0. A 2.1 release would signify the completion of remote logging that branch. I would recommend this branch for all distributions pulling new code in. The 2.0 branch will also have a couple more changes. I want to split up the audit source code a little bit. I want to drop the system-config-audit code and let it become standalone package updated and distributed separately. I also want to drop all audispd-plugins in the 2.0 branch and have them released separately. They cause unnecessary build dependencies for the audit package. During the work for a 2.2 release, I would also like to pull the audispd program inside auditd. In the past, I tried to keep auditd lean and single purpose, but with adding remote logging and kerberos support, we already have something that is hard to analyze. So, to improve performance and decrease system load, the audit daemon will also do event dispatching. Would this proposal impact anyone in a Bad Way? Thanks, -Steve

13 years, 10 months

4
11
0 / 0

missing user authentication events.

by Robert Harris

14 years, 4 months

3
5
0 / 0

ausearch

by Pittigher, Raymond - CS

I see that the -w or --word switch was added to the ausearch but how it it used? The man pages claim: String based matches must match the whole word. But I have been trying ausearch -w failed and variation of that but only get the message ausearch -if audit.log.3 -w failed failed is an unsupported option This e-mail and any files transmitted with it may be proprietary and are intended solely for the use of the individual or entity to whom they are addressed. If you have received this e-mail in error please notify the sender. Please note that any views or opinions presented in this e-mail are solely those of the author and do not necessarily represent those of ITT Corporation. The recipient should check this e-mail and any attachments for the presence of viruses. ITT accepts no liability for any damage caused by any virus transmitted by this e-mail.

15 years, 5 months

3
2
0 / 0

year value for ausearch?

by LC Bruzenak

Just got word back from a non-US fielded system that the ausearch -ts DAY/MONTH/YEAR doesn't work, e.g. : % ausearch -ts 04/29/2010 says that the year value is invalid but % ausearch -ts 04/29/10 works. Something with locale? It's F10 audit. Thx, LCB. -- LC (Lenny) Bruzenak lenny(a)magitekltd.com

15 years, 11 months

2
4
0 / 0

Did something break in RHEL5 with auid?

by Trevor Vaughan

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello all, In RHEL5.2 auditing worked fine for me auid was set to the user's uid and id was set to whatever it happened to be at the time. In RHEL5.4 auid got set to the 'anon' value. In RHEL5.5 auid gets set to '0' but uid is logged in original su entries. Any idea what happened? This makes it very difficult to capture su events where the user used to be something other than 0 without capturing a ton of other garbage as well (unless someone has an elegant solution for that). Thanks, Trevor -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) iEYEARECAAYFAkvKNYYACgkQSPJXuI7ODyuW/QCfbKUc8+e07JMSPSZ7N+JfwXYQ jLoAoMTI4tCxz/MY6ZMbFxv3XoMYJzTE =ojvM -----END PGP SIGNATURE-----

15 years, 12 months

2
1
0 / 0

stig.rules

by rshaw1＠umbc.edu

I've been trying to set up auditd for STIG compliance. I'm working with RHEL 5.5 and RHEL4 with their latest default kernels (2.6.18-194 and 2.6.9-89.0.23) and audit packages (1.7.17-3.el5 and 1.0.16-4.el4_8.1), though I'm just trying to get it working on a RHEL 5.5 machine to start. The stig.rules sample file is helpful, but I'm having difficulty filling in the missing parts (which I suppose is probably why they're missing). I checked Google and the past two years of list archives, and didn't find anything relevant (though I may have missed it). Specifically: - Monitoring system startup and shutdown. I could monitor all the relevant binaries (shutdown/halt/reboot/?), but I suspect there are ways around these. I'm not sure how to accurately monitor startup at all. - Use of print command (unsuccessful and successful). I tried modifying the "Use of privileged commands" rule to monitor the command-line print commands and cupsd, but this didn't catch printing via GUI apps through CUPS, and I suspect there must be a better way anyhow. There are cupsd audit entries, but these are from the permission change/deletion rules (I did move the print rules above those, close to the top). If I should just be monitoring these via another facility, that may also work. I'm also pondering the best way to get the RHEL4 machines to send their audit logs to a central server, as there seems to be no support for audisp at all (unless I'm missing something). Thanks, --Ray

16 years

3
2
0 / 0

Events lost with dispatcher

by Vishwanath Venkatesan

Hi, I having troubles receiving events with the dispatcher in ubuntu-9.04. I am just trying to use the rule -a entry, always -S execve -S exit_group I receive all the events in the audit.log, but not in the dispatcher. I am using the dispatcher code in the auditd website. I also using two threads where in one thread collects all the data and the other thread does the parsing. So there is no blocking and the queue is an unbounded concurrent queue. I don't think there can't anything else done at the receiving end. If anyone has faced something similar or have suggestions, please let me know Thanks Vish

16 years

3
6
0 / 0

Re: [PATCH] mapping of reactions

by Miloslav Trmac

Hello, the code looks reasonable, some minor comments are below. I'll let Steve and others comment on the high-level design (just to point out a question, is it OK that auditctl will depend on sqlite?). Mirek ----- "Juraj Hlista" <juro.hlista(a)gmail.com> wrote: > diff --git a/lib/libaudit.c b/lib/libaudit.c > @@ -965,6 +983,14 @@ int audit_rule_fieldpair_data(struct > audit_rule_data **rulep, const char *pair, > strncpy(&rule->buf[offset], v, vlen); > > break; > + case AUDIT_REACTION: > + /* string identifiers were converted to numbers */ > + if (isdigit((char)*(v))) Nitpick: the isdigit argument should be cast to (unsigned char). > diff --git a/lib/reactarray.c b/lib/reactarray.c <snip> > +int react_array_init(struct react_array *a, unsigned int size) <snip> > + a->str = (char **)malloc(size * sizeof(char *)); The return value of malloc() is not usually manually cast in C. > + if (!a->str) > + return 1; > + > + for (i = 0; i < size; i++) > + a->str[i] = NULL; You can just use calloc() to initialize a->str. <snip> > +void react_array_free(struct react_array *a) <snip> > + for (i = 0; i < a->count; i++) { > + if (a->str[i]) > + free(a->str[i]); free(NULL) is OK, so the if ( ) is not necessary. > +int react_array_insert(struct react_array *a, const char *s) > +{ <snip> > + a->str[a->count] = (char *)malloc((strlen(s) + 1) * sizeof(char)); > + if (!a->str[a->count]) > + return 1; > + > + strcpy(a->str[a->count], s); Using strdup() would be simpler. > diff --git a/src/auditctl-reactsql.c b/src/auditctl-reactsql.c <snip> > +enum { > + SQL_CHECK_DB = 0, Just use string constants in the code directly, this indirection is difficult to follow. <snip> > +void sql_print_error(sqlite3 *c, int err) <snip> > + fprintf(stderr, "SQLite error: %s\n", sql_errmsg[-err - 2]); The "-2" is a bit difficult to follow... I'd just sacrifice the two additional empty entries in sql_errmsg. <snip> > +int sql_number_to_reaction(sqlite3 *c, const int num, char **str) <snip> > + *str = malloc((strlen(reaction) + 1) * sizeof(char)); > + if (*str == NULL) { > + sqlite3_finalize(find_str); > + return -SQL_NO_MEMORY; > + } > + strcpy(*str, reaction); Use strdup (). <snip> > +/* > + * Add a reaction to the database - if 'num' is greater than SQL_OFFSET, > + * a reaction identifier (string) is already in the database and only > + * 'used' is incremented. If there is not such a reaction string, a new > + * one is inserted into the database and 'used' is set to 1. > + */ Using a separate variable for "new/existing" would be much cleaner than the magic SQL_OFFSET. Especially see how this implementation detail leaks into auditctl.c. <snip> > +int sql_get_next_number(sqlite3 *c, const char *str) Here as well. > diff --git a/src/auditctl.c b/src/auditctl.c > @@ -917,6 +972,97 @@ static int setopt(int count, int lineno, char <snip> > + if (num > SQL_OFFSET) > + asprintf(&cmd, "react=%u", num - SQL_OFFSET); > + else > + asprintf(&cmd, "react=%u", num); > + if (cmd) { (...) > + } else { > + fprintf(stderr, > + "Out of memory adding reaction\n"); > + sql_close_database(conn); > + return -4; > + } If you reverse the if (cmd) here, the else {} branch becomes the default control flow, resulting in a bit simpler code. > @@ -1022,6 +1168,7 @@ static int fileopt(const char *file) > > /* Parse it */ > if (reset_vars()) { > + free_vars(); I didn't look in detail, this does not match my understanding of "reset_vars()"; reset_vars() is supposed to reinitialize everything for a next command, not free everything. (The free(rule_new) call you moved from reset_vars() to free_vars() was at the beginning of reset_vars(), not at the end.) > @@ -1382,6 +1569,25 @@ static int audit_print_reply(struct audit_reply <snip> > + rc = sql_number_to_reaction(conn, > + rep->ruledata->values[i], > + &str_react); > + if (rc < 0) { I think it's prefereble to print the number if the lookup fails, so that the admin can see at least something from the rule.

16 years

4
5
0 / 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Linux-audit April 2010