October 2016 - Linux-audit - Linux-Audit List Archives

by Nil .

Hi, i would like to know if it is possible to log the parameters that a command get's passed on, i.e in the command ' ls -la', the logs only show comm="ls" and i would like to have the full comm="ls -la". is it possible anyhow using audit logs? do you know any other way to log those parameters? thank you

8 years

2
1
0 / 0

[userspace PATCH v2 0/2] Add support for loginuid_set

by Richard Guy Briggs

loginuid_set support should have been added to userspace when it was added to the kernel around v3.10. Add it before we do similar for sessionID and sessionID_set. There will be a number of users of features_bitmap within the same function (exclude filter extension, sessionID filter), so refactor audit_rule_fieldpair_data() to put audit_get_features earlier in the function. Richard Guy Briggs (2): get feature list only once Add user filter option loginuid_set from uapi macro AUDIT_LOGINUID_SET trunk/lib/errormsg.h | 2 ++ trunk/lib/fieldtab.h | 2 ++ trunk/lib/libaudit.c | 17 ++++++++++++++++- trunk/lib/libaudit.h | 6 ++++++ 4 files changed, 26 insertions(+), 1 deletions(-)

8 years

3
20
0 / 0

Question regarding ntpd

by Sullivan, Daniel [CRI]

Hi, I have what I hope to be a quick question regarding auditing ntpd. I am looking at my auditd log file and I see this same entry being repeated every second: type=SYSCALL msg=audit(1475012493.972:5325): arch=c000003e syscall=159 success=yes exit=0 a0=7ffd7498eb00 a1=861 a2=0 a3=1 items=0 ppid=1 pid=5357 auid=4294967295 uid=38 gid=38 euid=38 suid=38 fsuid=38 egid=38 sgid=38 fsgid=38 tty=(none) ses=4294967295 comm="ntpd" exe="/usr/sbin/ntpd" key="time-change" type=SYSCALL msg=audit(1475012494.971:5326): arch=c000003e syscall=159 success=yes exit=0 a0=7ffd7498eb00 a1=861 a2=0 a3=1 items=0 ppid=1 pid=5357 auid=4294967295 uid=38 gid=38 euid=38 suid=38 fsuid=38 egid=38 sgid=38 fsgid=38 tty=(none) ses=4294967295 comm="ntpd" exe="/usr/sbin/ntpd" key="time-change" type=SYSCALL msg=audit(1475012495.972:5327): arch=c000003e syscall=159 success=yes exit=0 a0=7ffd7498eb00 a1=861 a2=0 a3=1 items=0 ppid=1 pid=5357 auid=4294967295 uid=38 gid=38 euid=38 suid=38 fsuid=38 egid=38 sgid=38 fsgid=38 tty=(none) ses=4294967295 comm="ntpd" exe="/usr/sbin/ntpd" key="time-change” This is generating large amounts of log data. I am not an expert in auditd log analysis. Is this expected behavior? I am unsure of what the key time-change value of this log data is, and am wondering if this indicates some sort of misconfiguration or problem with ntpd. From looking at the output of tcpdump it does not look like I am polling every second, so I am wondering why this activity is occurring. If anybody could advise on how to decipher these log entries I would appreciate it. Thank you for your help and advisement. Best, Dan Sullivan ******************************************************************************** This e-mail is intended only for the use of the individual or entity to which it is addressed and may contain information that is privileged and confidential. If the reader of this e-mail message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is prohibited. If you have received this e-mail in error, please notify the sender and destroy all copies of the transmittal. Thank you University of Chicago Medicine and Biological Sciences ********************************************************************************

8 years

6
12
0 / 0

[userspace PATCH v2 0/2] add support for more fields to the exclude filter

by Richard Guy Briggs

Add userspace support for the exclude filter extension of subject credentials, including detection of the feature in the kernel. This set should be added after loginuid_set support and before sessionID user filter support to avoid merge conflicts. Richard Guy Briggs (2): exclude filter: add support for user filter fields Check exclude filter cred extension fields available in kernel trunk/docs/auditctl.8 | 2 +- trunk/lib/errormsg.h | 4 ++-- trunk/lib/libaudit.c | 29 +++++++++++++++++++++++++---- trunk/lib/libaudit.h | 3 +++ 4 files changed, 31 insertions(+), 7 deletions(-)

8 years

2
5
0 / 0

Re: Problem running auditd on Raspberry Pi (fedora-server-24)

by C.y

On Tue, Oct 4, 2016 at 4:06 AM, Steve Grubb <sgrubb(a)redhat.com> wrote: > On Sunday, October 2, 2016 11:00:16 AM EDT C.y wrote: > > On Sun, Oct 2, 2016 at 12:20 AM, Steve Grubb <sgrubb(a)redhat.com> wrote: > > > On Saturday, October 1, 2016 5:47:47 PM EDT C.y wrote: > > > > Hi all, > > > > > > > > > > > > I have fedora-server-24 installed on my raspberry-pi-3, following the > > > > guide https://fedoraproject.org/wiki/Raspberry_Pi. > > > > > > > > Once I get my raspberry pi boot up, there were error mentioning that > > > > "audit not support not in kernel", which I believed were then > resolved after I > > > > rebuild my kernel. > > > > > > > > However, I got stuck when I tried to add rule using `auditctl` > command > > > > as below: > > > > `# auditctl -w /etc/passwd -p wa -k passwd_changes` > > > > Error sending add rule data request (Invalid argument) > > > > > > Hmm. I wonder if 'ausyscall open' gives you syscalls. > > > > `# ausyscall open` returns as below. So I suppose the answer is > > yes?(correct me if I'm wrong) > > open 5 > > mq_open 274 > > openat 322 > > perf_event_open 364 > > open_by_handle_at 371 > > This means user space is doing the right thing. I am thinking this sounds > like > a kernel issue. > > Have you tried a few other simple commands? > > auditctl -e 1 > auditctl -s > auditctl -always,exit -F arch=b64 -S open > > -Steve `# auditctl -e 1` returns: enabled 1 failure 1 pid 293 rate_limit 0 backlog_limit 64 lost 11 backlog 0 backlog_wait_time 6000 `# auditctl -s` returns: enabled 1 failure 1 pid 293 rate_limit 0 backlog_limit 64 lost 11 backlog 0 backlog_wait_time 6000 `# auditctl -a always,exit -F arch=b64 -S open` returns: arch elf mapping not found `# auditctl -a always,exit -S open` returns: Error sending add rule data request (Invalid argument) I also noticed that auditd is having difficulty in parsing `/etc/auditd/auditd.rules` on the booting stage, `# journalctl -u auditd.service --this-boot` returns: -- Logs begin at Fri 2016-02-12 00:28:01 CST, end at Tue 2016-10-04 10:53:05 CST. -- Feb 12 00:28:06 raspi3.lab systemd[1]: Starting Security Auditing Service... Feb 12 00:28:06 raspi3.lab auditd[287]: Started dispatcher: /sbin/audispd pid: 301 Feb 12 00:28:06 raspi3.lab audispd[301]: priority_boost_parser called with: 4 Feb 12 00:28:06 raspi3.lab augenrules[288]: /sbin/augenrules: No change Feb 12 00:28:06 raspi3.lab audispd[301]: max_restarts_parser called with: 10 Feb 12 00:28:06 raspi3.lab augenrules[288]: Error sending add rule data request (Invalid argument) Feb 12 00:28:06 raspi3.lab augenrules[288]: There was an error in line 5 of /etc/audit/audit.rules Feb 12 00:28:06 raspi3.lab augenrules[288]: No rules Feb 12 00:28:06 raspi3.lab systemd[1]: Started Security Auditing Service. Feb 12 00:28:06 raspi3.lab auditd[287]: Init complete, auditd 2.5.2 listening for events (startup state while `# cat /etc/audit/rules.d` returns: ----- ## This file is automatically generated from /etc/audit/rules.d -D -a task,never ----- p/s: On the log above, RaspberryPi is showing the wrong time due to a reboot, the time will be corrected once the chronyd start functioning. Regards, CHING YI. > > > > I tried to search for solution but it lead me to a bug that were > already > > > > been solved like years ago. Can anyone tell me if I am in the right > way > > > > of getting auditd works on raspberry pi? Were the problem I've faced > were > > > > already a known issue? > > > > > > > > Below are my system information and some logs/details when I tried to > > > > diagnosis the problem and thanks a lot for your help in advance! > > > > > > > > `# uname -a` > > > > Linux raspi3.lab 4.4.23-v7+ #2 SMP Sat Oct 1 15:24:41 CST 2016 armv7l > > > > armv7l armv7l GNU/Linux > > > > > > I also wonder if we have a mismatch here. Is that armv seventy one or > armv > > > seven-el? Its coded in audit as seventy one. > > > > It's 7-el. > > `# uname -a | grep 7l` (7-el) returns > > Linux raspi3.lab 4.4.23-v7+ #2 SMP Sat Oct 1 15:24:41 CST 2016 armv7l > > armv7l armv7l GNU/Linux > > > > > > Sincerly, > > CHING YI. > > > > > -Steve > > > > > > > `# modprobe configs ; gunzip -dc /proc/config.gz | grep AUDIT` > > > > CONFIG_AUDIT=y > > > > CONFIG_NETFILTER_XT_TARGET_AUDIT=m > > > > CONFIG_AUDIT_GENERIC=y > > > > # CONFIG_AUDIT_ARCH_COMPAT_GENERIC is not set > > > > > > > > `# systemctl status auditd.service` > > > > ● auditd.service - Security Auditing Service > > > > > > > > Loaded: loaded (/usr/lib/systemd/system/auditd.service; enabled; > > > > vendor preset: enabled) > > > > > > > > Active: active (running) since Fri 2016-02-12 00:28:07 CST; 7 > months > > > > 19 days ago > > > > > > > > Process: 1553 ExecReload=/bin/kill -HUP $MAINPID (code=exited, > > > > status=0/SUCCESS) > > > > > > > > Process: 279 ExecStartPost=/sbin/augenrules --load (code=exited, > > > > status=1/FAILURE) > > > > Main PID: 278 (auditd) > > > > CGroup: /system.slice/auditd.service > > > > └─278 /sbin/auditd -n > > > > > > > > Oct 01 16:36:53 raspi3.lab auditd[278]: audit(1475311013.356:8458) > > > > op=reconfigure state=changed auid=4294967295 pid=-1 subj=? > res=success > > > > Oct 01 16:36:53 raspi3.lab systemd[1]: Reloaded Security Auditing > > > > Service. > > > > Oct 01 16:37:28 raspi3.lab systemd[1]: Reloading Security Auditing > > > > Service. > > > > Oct 01 16:37:28 raspi3.lab auditd[278]: config change requested by > > > > pid=-1 > > > > auid=4294967295 subj=? > > > > Oct 01 16:37:28 raspi3.lab auditd[278]: audit(1475311048.046:257) > > > > op=reconfigure state=changed auid=4294967295 pid=-1 subj=? > res=success > > > > Oct 01 16:37:28 raspi3.lab systemd[1]: Reloaded Security Auditing > > > > Service. > > > > Oct 01 16:38:18 raspi3.lab systemd[1]: Reloading Security Auditing > > > > Service. > > > > Oct 01 16:38:18 raspi3.lab auditd[278]: config change requested by > > > > pid=-1 > > > > auid=4294967295 subj=? > > > > Oct 01 16:38:18 raspi3.lab auditd[278]: audit(1475311098.716:2108) > > > > op=reconfigure state=changed auid=4294967295 pid=-1 subj=? > res=success > > > > Oct 01 16:38:18 raspi3.lab systemd[1]: Reloaded Security Auditing > > > > Service. > > > > > > > > While my `/var/log/audit/audit.log` was full with lines of > > > > "SERVICE_START" & "SERVICE_STOP": > > > > type=SERVICE_START msg=audit(1475313700.696:276): pid=1 uid=0 > > > > auid=4294967295 ses=4294967295 msg='unit=NetworkManager-dispatcher > > > > comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? > > > > terminal=? res=success' > > > > type=SERVICE_STOP msg=audit(1475313710.836:277): pid=1 uid=0 > > > > auid=4294967295 ses=4294967295 msg='unit=NetworkManager-dispatcher > > > > comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? > > > > terminal=? res=success' > > > > > > > > > > > > Sincerly, > > > > CHING YI. >

8 years

2
2
0 / 0

commands in hex vs ASCII

by Kevin Brown

Hello, Is there an option within auditd to set whether commands are stored as hex vs ASCII? With the prevalence of SIEM these days, seems easier to keep the commands as ASCII and not presume a person needs to have access to a local system to run ausearch. Have gone through the documentation but didn't see an answer. Thanks

8 years

5
5
0 / 0

[PATCH] audit-userspace: add GitHub issue template

by Paul Moore

This patch should be a harmless addition to the subversion repository but it will add an issue template for the GitHub mirror. * GitHub audit userspace mirror -> https://github.com/linux-audit/audit-userspace Signed-off-by: Paul Moore <paul(a)paul-moore.com> --- .github/ISSUE_TEMPLATE.md | 2 ++ 1 file changed, 2 insertions(+) create mode 100644 .github/ISSUE_TEMPLATE.md diff --git a/.github/ISSUE_TEMPLATE.md b/.github/ISSUE_TEMPLATE.md new file mode 100644 index 0000000..c2f93e9 --- /dev/null +++ b/.github/ISSUE_TEMPLATE.md @@ -0,0 +1,2 @@ +**NOTE:** Please refer to the [Reporting Bug and Requesting Features](https://github.com/linux-audit/audit-documentation/wiki/Reporti... wiki page before creating any new GitHub issues. +

8 years

1
0
0 / 0

LOG_WARN or LOG_WARNING?

by leam hall

For /etc/audisp/plugins.d/syslog.conf, is "LOG_WARN" an accpeted arg, or does it need to be "LOG_WARNING"? Thanks! Leam -- Mind on a Mission <http://leamhall.blogspot.com/>

8 years

3
8
0 / 0

[GIT PULL] Audit patches for v4.9

by Paul Moore

Hi Linus, Another relatively small pull request for v4.9 with just two patches. The patch from Richard updates the list of features we support and report back to userspace; this should of been sent earlier with the rest of the v4.8 patches but it got lost in my inbox. The second patch fixes a problem reported by our Android friends where we weren't very consistent in recording PIDs. Please merge these patches for v4.9. Thanks, -Paul --- The following changes since commit 523d939ef98fd712632d93a5a2b588e477a7565e: Linux 4.7 (2016-07-24 12:23:50 -0700) are available in the git repository at: git://git.infradead.org/users/pcmoore/audit stable-4.9 for you to fetch changes up to 7ff89ac608d9e856cae6fa651553fa0709bf9c50: audit: add exclude filter extension to feature bitmap (2016-09-29 13:12:09 -0400) ---------------------------------------------------------------- Paul Moore (1): audit: consistently record PIDs with task_tgid_nr() Richard Guy Briggs (1): audit: add exclude filter extension to feature bitmap include/uapi/linux/audit.h | 4 +++- kernel/audit.c | 8 +++++++- kernel/auditsc.c | 12 ++++++------ security/lsm_audit.c | 4 ++-- 4 files changed, 18 insertions(+), 10 deletions(-) -- paul moore security @ redhat

8 years

1
0
0 / 0

ausearch checkpoint question

by LC Bruzenak

I'm using the 2.4.5-3 audit rpm set and I tried using the ausearch "checkpoint" option a couple weeks ago. This was on a moderately busy system (judging by my own systems/experience) generating say 300-400MB of data/day. I tried the checkpoint option in a 5-minute cron job, and I noticed that in comparison to the "-ts recent" option, it took far longer to complete. The "recent" option result was less than a second, whereas the checkpoint version took ~20 seconds every 5 minutes. It's possible there were other factors at play; e.g. it was used on a mls-policy machine, and although I saw no AVCs, it's possible there were some access issues I didn't have time to investigate. On my intended application, I'll be on a standard targeted-policy machine so this won't be a potential factor. I need to test this again, as I'm considering using the ausearch checkpoint capability for some new requirements, I was wondering if perhaps there were any timing results done or if there are any tips and tricks to getting the most out of it. Also - the man page section describing this is a little confusing to me so if anyone has a script segment that would be very helpful. Thanks in advance, LCB -- LC Bruzenak magitekltd.com

8 years

2
2
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Linux-audit October 2016