May 2010 - Linux-audit - Linux-Audit List Archives

by LC Bruzenak

I know I can go look at the code, however I figured I'd ask here first about the limits on the user message in both audit_log_user_message and ausearch. With audit_log_user_message the maximum length allowed appears to be around MAX_AUDIT_MESSAGE_LENGTH-100. I think it may depend on the executable name length (and other stuff auto-pushed into the string) which is why I say "around". Even when I get a successful return value (from audit_log_user_message), I don't get my string back out in "ausearch" unless it is WAY smaller - ~1K or less I think. Any ideas/thoughts? This is the latest (1.7.11-2) audit package. Thx, LCB. -- LC (Lenny) Bruzenak lenny(a)magitekltd.com

11 years, 6 months

5
17
0 / 0

AUDIT_SIGNAL_INFO

by Matthew Booth

Under what circumstances will the RHEL 4 kernel generate a message of type AUDIT_SIGNAL_INFO? My understanding is that it should be sent when a process sends a signal to the audit daemon, however I have not observed that. Any ideas? Thanks, Matt -- Matthew Booth, RHCA, RHCSS Red Hat, Global Professional Services M: +44 (0)7977 267231 GPG ID: D33C3490 GPG FPR: 3733 612D 2D05 5458 8A8A 1600 3441 EA19 D33C 3490

12 years, 10 months

3
4
0 / 0

Near Term Audit Road Map

by Steve Grubb

Hi, With the proposals sent to the list, I wanted to talk about how this might play out code-wise. With regard to the current code base, I am working on a 1.8 release. This would represent finishing the remote logging app and nothing more. The 1.8 series would become just an update series just like the 1.0.x series did. In parallel with finishing remote logging, I would release a 2.0 version. Patches applied to 1.8 would also be applied to 2.0. A 2.1 release would signify the completion of remote logging that branch. I would recommend this branch for all distributions pulling new code in. The 2.0 branch will also have a couple more changes. I want to split up the audit source code a little bit. I want to drop the system-config-audit code and let it become standalone package updated and distributed separately. I also want to drop all audispd-plugins in the 2.0 branch and have them released separately. They cause unnecessary build dependencies for the audit package. During the work for a 2.2 release, I would also like to pull the audispd program inside auditd. In the past, I tried to keep auditd lean and single purpose, but with adding remote logging and kerberos support, we already have something that is hard to analyze. So, to improve performance and decrease system load, the audit daemon will also do event dispatching. Would this proposal impact anyone in a Bad Way? Thanks, -Steve

12 years, 10 months

4
11
0 / 0

missing user authentication events.

by Robert Harris

13 years, 4 months

3
5
0 / 0

ausearch

by Pittigher, Raymond - CS

I see that the -w or --word switch was added to the ausearch but how it it used? The man pages claim: String based matches must match the whole word. But I have been trying ausearch -w failed and variation of that but only get the message ausearch -if audit.log.3 -w failed failed is an unsupported option This e-mail and any files transmitted with it may be proprietary and are intended solely for the use of the individual or entity to whom they are addressed. If you have received this e-mail in error please notify the sender. Please note that any views or opinions presented in this e-mail are solely those of the author and do not necessarily represent those of ITT Corporation. The recipient should check this e-mail and any attachments for the presence of viruses. ITT accepts no liability for any damage caused by any virus transmitted by this e-mail.

14 years, 5 months

3
2
0 / 0

Auditing tcpdump&co

by Jure Simsic

Hi, I'm trying to catch all events of any net sniffers aka tcpdump, snoop, ethereal... I think I managed to make a rule that will do that: -a entry,always -S socketcall -F euid=0 -F a0=3 I've played around and I think it does the trick. Do you see any problems with this rule? The problem I'm trying to solve now is how to get a daily report of all such events. I was trying to filter it on ausearch -m SYSCALL -sc socketcall -ue 0 but I get all possilble sshd,ftpd and the bunch as well.. I could do post processing with a whitelist and ignore all I know are ok, but it would be much nicer if I could get the search a bit narrower in the first place. Any ideas? Thanks Jure

14 years, 10 months

2
1
0 / 0

Re: [audit] Suppress runtime loading of audit module.

by James Morris

Might be best for the networking folk to look at this. On Mon, 24 May 2010, Tetsuo Handa wrote: > I noticed that request_module("net-pf-16-proto-9") is issued whenever 'Enter' > key is pressed if CONFIG_AUDIT=n and console is /dev/tty0 . net-pf-16-proto-9 > is known as audit but CONFIG_AUDIT is "bool". Therefore, trying to load > net-pf-16-proto-9 at runtime does not make sense. > > Call trace obtained by inserting WARN_ON(protocol == 9); > ------------[ cut here ]------------ > WARNING: at net/netlink/af_netlink.c:450 netlink_create+0x1cd/0x1e0() > Hardware name: VMware Virtual Platform > Modules linked in: mptspi mptscsih mptbase scsi_transport_spi ext3 jbd mbcache > Pid: 1, comm: bash Not tainted 2.6.34 #10 > Call Trace: > [<c06227ad>] ? netlink_create+0x1cd/0x1e0 > [<c043c9cc>] warn_slowpath_common+0x7c/0xa0 > [<c06227ad>] ? netlink_create+0x1cd/0x1e0 > [<c043ca05>] warn_slowpath_null+0x15/0x20 > [<c06227ad>] netlink_create+0x1cd/0x1e0 > [<c0600790>] ? __sock_create+0xe0/0x240 > [<c06225e0>] ? netlink_create+0x0/0x1e0 > [<c06007b8>] __sock_create+0x108/0x240 > [<c060072e>] ? __sock_create+0x7e/0x240 > [<c060095a>] sock_create+0x3a/0x50 > [<c0600ae6>] sys_socket+0x36/0x60 > [<c0601f69>] sys_socketcall+0x89/0x290 > [<c0402b83>] ? sysenter_exit+0xf/0x18 > [<c0524db4>] ? trace_hardirqs_on_thunk+0xc/0x10 > [<c0402b50>] sysenter_do_call+0x12/0x36 > ---[ end trace 4da698b4c0bf1613 ]--- > > Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> > --- > net/netlink/af_netlink.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > --- linux-2.6.34.orig/net/netlink/af_netlink.c > +++ linux-2.6.34/net/netlink/af_netlink.c > @@ -446,7 +446,7 @@ static int netlink_create(struct net *ne > > netlink_lock_table(); > #ifdef CONFIG_MODULES > - if (!nl_table[protocol].registered) { > + if (!nl_table[protocol].registered && protocol != 9) { > netlink_unlock_table(); > request_module("net-pf-%d-proto-%d", PF_NETLINK, protocol); > netlink_lock_table(); > -- > To unsubscribe from this list: send the line "unsubscribe linux-security-module" in > the body of a message to majordomo(a)vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html > -- James Morris <jmorris(a)namei.org>

14 years, 10 months

1
0
0 / 0

auditd syslog builtin plugin

by cosmih

Hi, I am trying to make the builtin syslog audisp plugin to use a custom facility/priority pair for the syslog messages exported to the syslog daemon. For that I am using the patch and the conf from below. The problem is that the compile and the start process don't give any errors when I am using the below customization but the syslog daemon receive the messages from the audisp with the default facility (LOG_USER). So I need a littel help here. I would appreciate any help. Thanks, -- Cosmih ============================================================ /etc/audisp/plugins.d/syslog.conf active = yes direction = out path = builtin_syslog type = builtin args = LOG_ALERT LOG_KERN format = string ============================================================ ============================================================ diff -ur audit-2.0.4/audisp/audispd-builtins.c audit-2.0.4-new/audisp/audispd-builtins.c --- audit-2.0.4/audisp/audispd-builtins.c 2009-12-07 23:16:41.000000000 +0200 +++ audit-2.0.4-new/audisp/audispd-builtins.c 2010-05-25 16:56:18.000000000 +0300 @@ -37,7 +37,7 @@ // Local data static volatile int sock = -1, conn = -1; -static int syslog_started = 0, priority; +static int syslog_started = 0, priority, facility; static char *path = NULL; // Local prototypes @@ -278,8 +278,25 @@ syslog_started = 0; return; } - } else + } else { priority = LOG_INFO; + } + if (conf->args[2]) { + if (strcasecmp(conf->args[2], "LOG_USER") == 0) + facility = LOG_USER + else if (strcasecmp(conf->args[2], "LOG_DAEMON") == 0) + facility = LOG_DAEMON; + else if (strcasecmp(conf->args[2], "LOG_KERN") == 0) + facility = LOG_KERN; + else { + syslog(LOG_ERR, "Unknown log priority %s", + conf->args[2]); + syslog_started = 0; + return; + } + else { + facility = LOG_KERN; + } syslog_started = 1; syslog(LOG_INFO, "syslog plugin initialized"); } @@ -287,7 +304,7 @@ void send_syslog(const char *s) { if (syslog_started) - syslog(priority, "%s", s); + syslog(facility|priority, "%s", s); } void destroy_syslog(void) ============================================================

14 years, 10 months

2
2
0 / 0

EXECVE record

by Klaus Heinrich Kiwi

type=PATH msg=audit(05/21/2010 10:59:08.167:35) : item=1 name=(null) inode=3535788 dev=fd:00 mode=file,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(05/21/2010 10:59:08.167:35) : item=0 name=/usr/libexec/qemu-kvm inode=509820 dev=fd:00 mode=file,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:qemu_exec_t:s0 type=CWD msg=audit(05/21/2010 10:59:08.167:35) : cwd=/ type=EXECVE msg=audit(05/21/2010 10:59:08.167:35) : argc=6 a0=/usr/libexec/qemu-kvm a1=-S a2=-M a3=rhel5.4.0 a4=-m a5=512 a6=-smp a7=1 a8=-name a9=kvm01 a10=-uuid a11=dab72a67-a431-d39e-3c7c-89c5fa313b8c a12=-no-kvm-pit-reinjection a13=-monitor a14=pty a15=-pidfile a16=/var/run/libvirt/qemu//kvm01.pid a17=-boot a18=c a19=-drive a20=file=/var/lib/libvirt/images/kvm01,if=virtio,index=0,boot=on,cache=none a21=-drive a22=file=/root/RHEL5.5-Server-20100322.0-x86_64-DVD.iso,if=ide,media=cdrom,index=2,cache=none a23=-net a24=nic,macaddr=54:52:00:dd:f5:c6,vlan=0 a25=-net a26=tap,fd=11,script=,vlan=0,ifname=virtnet7 a27=-serial a28=pty a29=-parallel a30=none a31=-usb a32=-vnc a33=127.0.0.1:0 a34=-k a35=en-us type=SYSCALL msg=audit(05/21/2010 10:59:08.167:35) : arch=x86_64 syscall=execve success=yes exit=0 a0=6bca700 a1=6bca3c0 a2=6bc3240 a3=38c2016220 items=2 ppid=2809 pid=2810 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=4294967295 comm=qemu-kvm exe=/usr/libexec/qemu-kvm subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 key=virt_qemu_exec Just wanted to check if I got the meaning of the EXECVE record right. Should the 'argc' field bring the number of argv[] items? Why is argc=6 in the record above if we apparently have 36 items? uname -a: Linux lepton.ltc.br.ibm.com 2.6.18-199.el5 #1 SMP Fri May 14 15:30:11 EDT 2010 x86_64 x86_64 x86_64 GNU/Linux -Klaus -- Klaus Heinrich Kiwi | klausk(a)br.ibm.com | http://blog.klauskiwi.com Open Source Security blog : http://www.ratliff.net/blog IBM Linux Technology Center : http://www.ibm.com/linux/ltc

14 years, 10 months

1
0
0 / 0

Linux event information

by Bryan Kropf

14 years, 10 months

1
0
0 / 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Linux-audit May 2010