July 2016 - Linux-audit - Linux-Audit List Archives

USER_CMD

by Chris Nandor

How does one get USER_CMD records into the audit.log? --Chris

9 years

2
6
0 / 0

Re: Linux-audit Digest, Vol 142, Issue 18

by aung

Hi All, Please ask me one question regarding about of RHEL security. To hack RHEL root privilege is possible or not ? Even this system didn't try to patch update CVE,RHSA and so on. Thanks in advance for your feedback. All the best, -Aung On Thu, Jul 14, 2016 at 10:30 PM, <linux-audit-request(a)redhat.com> wrote: > Send Linux-audit mailing list submissions to > linux-audit(a)redhat.com > > To subscribe or unsubscribe via the World Wide Web, visit > https://www.redhat.com/mailman/listinfo/linux-audit > or, via email, send a message with subject or body 'help' to > linux-audit-request(a)redhat.com > > You can reach the person managing the list at > linux-audit-owner(a)redhat.com > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Linux-audit digest..." > > > Today's Topics: > > 1. Re: Weird issues in 2.6.5 (Chris Nandor) > 2. [PATCH] Fix whitespace in CWD record (Steve Grubb) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 13 Jul 2016 15:22:01 -0700 > From: Chris Nandor <pudge(a)pobox.com> > To: Steve Grubb <sgrubb(a)redhat.com> > Cc: linux-audit(a)redhat.com > Subject: Re: Weird issues in 2.6.5 > Message-ID: > <CAHcE2wrPftjsy2QMB4+qsa9o-S= > xWqjiD+rtKX0wM24ksT0tkQ(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > I set heartbeat to 60 on the client and idle to 120 on the server. > Reconnects seem fine now, although I never did nail down the exact > conditions under which reconnects failed. > > But I still have the problem of weird buffering on the client side. If I > run `sudo ls` on the client side, locally I get something like: > > node=grax.sea.marchex.com type=SYSCALL > msg=audit(1468448156.161:3288765): arch=c000003e syscall=59 success=yes > exit=0 a0=8f81e8 a1=8f7578 a2=8febf0 a3=7ffd3d956370 items=2 ppid=19387 > pid=19388 auid=2288 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 > tty=pts4 ses=399 comm="ls" exe="/bin/ls" key="rootcmd" > node=grax.sea.marchex.com type=EXECVE > msg=audit(1468448156.161:3288765): argc=1 a0="ls" > node=grax.sea.marchex.com type=CWD msg=audit(1468448156.161:3288765): > cwd="/tmp" > node=grax.sea.marchex.com type=PATH msg=audit(1468448156.161:3288765): > item=0 name="/bin/ls" inode=132438 dev=09:01 mode=0100755 ouid=0 ogid=0 > rdev=00:00 > node=grax.sea.marchex.com type=PATH msg=audit(1468448156.161:3288765): > item=1 name=(null) inode=71179 dev=09:01 mode=0100755 ouid=0 ogid=0 > rdev=00:00 > > But remotely, I just get: > > node=grax.sea.marchex.com type=SYSCALL > msg=audit(1468448156.161:3288765): arch=c000003e syscall=59 success=yes > exit=0 a0=8f81e8 a1=8f7578 a2=8febf0 a3=7ffd3d956370 items=2 ppid=19387 > pid=19388 auid=2288 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 > tty=pts4 ses=399 comm="ls" exe="/bin/ls" key="rootcmd" > > Just the first line of the audit record. No matter how long I wait. If I > then run `sudo ls` again, *then* the rest of the lines show up in the > server's log. > > The buffering appears to be on the client side, because if I restart the > server's auditd, those lines are not lost: they still appear in the remote > log ... but not until the next time I run `sudo ls` on the client side. > > This is on 1.7.x. This does not happen on 2.4.x or 2.6.x. > > > > > > > > On Wed, Jul 13, 2016 at 11:38 AM, Steve Grubb <sgrubb(a)redhat.com> wrote: > > > On Wednesday, July 13, 2016 10:51:07 AM EDT Chris Nandor wrote: > > > The only reason I am even upgrading is because of the issues with > > > audisp-remote, the not-reconnecting, and the apparent client-side > > > buffering, that went away with 2.4.x and 2.6.x. So if we decide to > ship > > > logs a different way than with audisp-remote, then it might be best to > > > stick with 1.7.x. > > > > This sounds a lot like the idle detection is not set right. In audisp- > > remote.conf there is a setting heartbeat_timeout. This should be set to > > something like 60 or 120. Then on the server in auditd.conf there is a > > setting > > tcp_client_max_idle which should be over twice as high as > > heartbeat_timeout. > > So, you'd set it to 180 or 300. > > > > > That said, so far I see no issues, so we're going to forge ahead and > see > > > what happens. I just need to keep in mind what our mitigation plan > would > > > be if we do run into issues. > > > > Old utilities won't know what to do with enriched events. AFAICS, that > > would > > be the long term issue. You'll need to do aperl, awk, or cut command to > > trim > > off the unknown part of the event in your logs. > > > > -Steve > > > -------------- next part -------------- > An HTML attachment was scrubbed... > URL: < > https://www.redhat.com/archives/linux-audit/attachments/20160713/023e5d70... > > > > ------------------------------ > > Message: 2 > Date: Thu, 14 Jul 2016 10:59:19 -0400 > From: Steve Grubb <sgrubb(a)redhat.com> > To: linux-audit(a)redhat.com > Subject: [PATCH] Fix whitespace in CWD record > Message-ID: <1772571.A9vuBSQyZx@x2> > Content-Type: text/plain; charset="us-ascii" > > Fix the whitespace in the CWD record > > Signed-off-by: Steve Grubb <sgrubb(a)redhat.com> > --- > kernel/auditsc.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff -urp linux-4.7.0-0.rc4.git1.1.fc23.x86_64.orig/kernel/auditsc.c > linux-4.7.0-0.rc4.git1.1.fc23.x86_64/kernel/auditsc.c > --- linux-4.7.0-0.rc4.git1.1.fc23.x86_64.orig/kernel/auditsc.c 2016-06-25 > 12:44:41.756440052 -0400 > +++ linux-4.7.0-0.rc4.git1.1.fc23.x86_64/kernel/auditsc.c 2016-07-14 > 09:56:50.222227280 -0400 > @@ -1426,7 +1426,7 @@ static void audit_log_exit(struct audit_ > if (context->pwd.dentry && context->pwd.mnt) { > ab = audit_log_start(context, GFP_KERNEL, AUDIT_CWD); > if (ab) { > - audit_log_d_path(ab, " cwd=", &context->pwd); > + audit_log_d_path(ab, "cwd=", &context->pwd); > audit_log_end(ab); > } > } > > > > ------------------------------ > > -- > Linux-audit mailing list > Linux-audit(a)redhat.com > https://www.redhat.com/mailman/listinfo/linux-audit > > End of Linux-audit Digest, Vol 142, Issue 18 > ******************************************** >

9 years

1
0
0 / 0

Questions about the standard (Google Summer of Code Project)

by Mateusz Piotrowski

Hi, I participate in Google Summer of Code and my project involves converting Linux Audit logs to BSM logs. As I was writing a parser and converter I stumbled upon a couple of things I do not understand and I cannot find in the documentation: 1. Where are all the elements like auditd start, user, etc. listed? I cannot find any document which specifies what can occurs between the colon (separating the type and the msg=audit(…) from the fields) and the record’s fields. 2. Why are there two spaces between the colon and the first field in records of type=CWD and a field cwd=“/root”? Here’s an example: type=CWD msg=audit(1464013682.961:409): cwd="/root” 3. According to Red Hat’s documentation[1]: > Each record consists of several name=value pairs separated by a white space or a comma. a) Is a white space always a space? Can be any white space like the tab character? b) Why do some records are separated by a comma and a whitespace? Example: type=DAEMON_START msg=audit(1363713609.192:5426): auditd start, ver=2.2 format=raw kernel=2.6.32-358.2.1.el6.x86_64 auid=500 pid=4979 subj=unconfined_u:system_r:auditd_t:s0 res=success I’ve posted the question on Unix & Linux SE: [3]. 4. Is it possible that there are duplicate fields in a record? Something like (which doesn’t make much sense obviously): type=CWD msg=audit(1464013682.961:409): cwd="/root” cwd=“/usr” I’ve already asked a similar question on Unix & Linux SE: [4]. 5. Is there a document which answers my questions? That would be cool! Thanks a lot for help! Cheers! Matuesz Piotrowski [GSoC project’s wiki]: https://wiki.freebsd.org/SummerOfCode2016/NonBSMtoBSMConversionTools <https://wiki.freebsd.org/SummerOfCode2016/NonBSMtoBSMConversionTools> [1]: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/... <https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/...> [3]: http://unix.stackexchange.com/questions/293975/undocumented-format-of-lin... <http://unix.stackexchange.com/questions/293975/undocumented-format-of-lin...> [4]: http://unix.stackexchange.com/questions/293809/can-i-be-sure-that-the-nam... <http://unix.stackexchange.com/questions/293809/can-i-be-sure-that-the-nam...>

9 years

2
3
0 / 0

audit 2.6.5 released

by Steve Grubb

Hello, I've just released a new version of the audit daemon. It can be downloaded from http://people.redhat.com/sgrubb/audit. It will also be in rawhide soon. The ChangeLog is: - Correct the header length for dispatched events - Revise buffer handling in auditd to fix dispatched events - Fix spelling in man pages - Add documentation link to systemd unit file - Correct af_unix pathname detection in ausearch/report - Add remote_ended info to audisp-remote stat dump This release fixes truncated records passed to audisp plugins when the old event format was used. It was also discovered that ausearch was not picking up patchnames for af_unix sockets and this was corrected. Besides that there were several documentation fixups. Please let me know if you run across any problems with this release. -Steve

9 years

1
0
0 / 0

euid missing

by Chris Nandor

As mentioned in previous e-mail, we want to log what users do as root. I have these two rules, only: -a exit,always -F arch=b32 -F euid=0 -F auid>=0 -F auid!=4294967295 -S execve -k rootcmd -a exit,always -F arch=b64 -F euid=0 -F auid>=0 -F auid!=4294967295 -S execve -k rootcmd But this line shows up: node=grax.sea.marchex.com type=ANOM_ABEND msg=audit(1468426871.752:3282575): auid=811 uid=811 gid=811 ses=12 pid=18504 comm="chromium-browse" reason="seccomp" sig=0 syscall=91 compat=0 ip=0x7f296c759c77 code=0x50001 My guess is that it is because euid is missing; maybe euid=0 is true if euid is null? I could put uid=0, instead of euid ... but that isn't exactly what I want, I think. Is there a way to have the rule require euid actually be 0? --Chris

9 years

2
2
0 / 0

RE: Upgrading audit package

by Bhagwat, Shriniketan Manjunath

Hi Steve, As requested in my previous email, I am interested in understanding the relation between Linux audit kernel and user space audit. Will a audit kernel available with Linux kernel 2.6.32 compatible with user space audit 2.6.X? I understand you might be busy with your regular schedules. :-) Regards, Ketan From: Bhagwat, Shriniketan Manjunath Sent: Monday, July 11, 2016 1:48 PM To: 'Steve Grubb' <sgrubb(a)redhat.com> Cc: linux-audit(a)redhat.com Subject: Upgrading audit package Hi Steve, I am using audit in my development environment. My development environment is as below. RHEL 5.2 with kernel 2.6.32-431.el6.x86_64 and audit-2.2-2.el6.x86_64. SUSE 11 SP3 with kernel 3.0.76-0.11-default and audit-1.8-0.30.1 As I understand the above audit packages I am using in my environment are user space audit. I want to upgrade it to the latest version. If I upgrade the audit packages to latest version 2.6.X will there be any issues? Linux Audit kernel available with kernel 2.6.32-431.el6.x86_64 and 3.0.76-0.11 are compatible with user space audit 2.6.X? In your opinion what is the suitable audit package for my environment to upgrade? If these topics are already documented please guide me to the documentation. Regards, Ketan

9 years

2
1
0 / 0

[PATCH] capabilities: audit capability use

by Topi Miettinen

There are many basic ways to control processes, including capabilities, cgroups and resource limits. However, there are far fewer ways to find out useful values for the limits, except blind trial and error. Currently, there is no way to know which capabilities are actually used. Even the source code is only implicit, in-depth knowledge of each capability must be used when analyzing a program to judge which capabilities the program will exercise. Generate an audit message at system call exit, when capabilities are used. This can then be used to configure capability sets for services by a software developer, maintainer or system administrator. Test case demonstrating basic capability monitoring with the new message types 1330 and 1331 and how the cgroups are displayed (boot to rdshell): BusyBox v1.22.1 (Debian 1:1.22.0-19) built-in shell (ash) Enter 'help' for a list of built-in commands. (initramfs) cd /sys/fs (initramfs) mount -t cgroup2 cgroup cgroup [ 12.343152] audit_printk_skb: 5886 callbacks suppressed [ 12.355214] audit: type=1300 audit(1468234317.100:518): arch=c000003e syscall=165 success=yes exit=0 a0=7fffe1e9ae2d a1=7fffe1e9ae34 a2=7fffe1e9ae25 a3=8000 items=0 ppid=469 pid=470 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=ttyS0 ses=4294967295 comm="mount" exe="/bin/mount" key=(null) [ 12.414853] audit: type=1327 audit(1468234317.100:518): proctitle=6D6F756E74002D74006367726F757032006367726F7570006367726F7570 [ 12.438338] audit: type=1330 audit(1468234317.100:518): cap_used=0000000000200000 [ 12.453893] audit: type=1331 audit(1468234317.100:518): cgroups=:/; (initramfs) cd cgroup (initramfs) mkdir test; cd test [ 17.335625] audit: type=1300 audit(1468234322.092:519): arch=c000003e syscall=83 success=yes exit=0 a0=7ffddfd75e29 a1=1ff a2=0 a3=1e2 items=0 ppid=469 pid=471 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=ttyS0 ses=4294967295 comm="mkdir" exe="/bin/mkdir" key=(null) [ 17.392686] audit: type=1327 audit(1468234322.092:519): proctitle=6D6B6469720074657374 [ 17.409404] audit: type=1330 audit(1468234322.092:519): cap_used=0000000000000002 [ 17.425404] audit: type=1331 audit(1468234322.092:519): cgroups=:/; (initramfs) echo $$ >cgroup.procs (initramfs) mknod /dev/z_$$ c 1 2 [ 28.385681] audit: type=1300 audit(1468234333.144:520): arch=c000003e syscall=133 success=yes exit=0 a0=7ffe16324e11 a1=21b6 a2=102 a3=5c9 items=0 ppid=469 pid=472 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=ttyS0 ses=4294967295 comm="mknod" exe="/bin/mknod" key=(null) [ 28.443674] audit: type=1327 audit(1468234333.144:520): proctitle=6D6B6E6F64002F6465762F7A5F343639006300310032 [ 28.465888] audit: type=1330 audit(1468234333.144:520): cap_used=0000000008000000 [ 28.482080] audit: type=1331 audit(1468234333.144:520): cgroups=:/test; (initramfs) chown 1234 /dev/z_* [ 34.772992] audit: type=1300 audit(1468234339.532:521): arch=c000003e syscall=92 success=yes exit=0 a0=7ffd0b563e17 a1=4d2 a2=0 a3=60a items=0 ppid=469 pid=473 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=ttyS0 ses=4294967295 comm="chown" exe="/bin/chown" key=(null) [ 34.828569] audit: type=1327 audit(1468234339.532:521): proctitle=63686F776E0031323334002F6465762F7A5F343639 [ 34.848747] audit: type=1330 audit(1468234339.532:521): cap_used=0000000000000001 [ 34.864404] audit: type=1331 audit(1468234339.532:521): cgroups=:/test; Signed-off-by: Topi Miettinen <toiwoton(a)gmail.com> --- include/linux/audit.h | 4 +++ include/linux/cgroup.h | 2 ++ include/uapi/linux/audit.h | 2 ++ kernel/audit.c | 7 +++--- kernel/audit.h | 1 + kernel/auditsc.c | 28 ++++++++++++++++++++- kernel/capability.c | 5 ++-- kernel/cgroup.c | 62 ++++++++++++++++++++++++++++++++++++++++++++++ 8 files changed, 105 insertions(+), 6 deletions(-) diff --git a/include/linux/audit.h b/include/linux/audit.h index e38e3fc..971cb2e 100644 --- a/include/linux/audit.h +++ b/include/linux/audit.h @@ -438,6 +438,8 @@ static inline void audit_mmap_fd(int fd, int flags) __audit_mmap_fd(fd, flags); } +extern void audit_log_cap_use(int cap); + extern int audit_n_rules; extern int audit_signals; #else /* CONFIG_AUDITSYSCALL */ @@ -545,6 +547,8 @@ static inline void audit_mmap_fd(int fd, int flags) { } static inline void audit_ptrace(struct task_struct *t) { } +static inline void audit_log_cap_use(int cap) +{ } #define audit_n_rules 0 #define audit_signals 0 #endif /* CONFIG_AUDITSYSCALL */ diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h index a20320c..b5dc8aa 100644 --- a/include/linux/cgroup.h +++ b/include/linux/cgroup.h @@ -100,6 +100,8 @@ char *task_cgroup_path(struct task_struct *task, char *buf, size_t buflen); int cgroupstats_build(struct cgroupstats *stats, struct dentry *dentry); int proc_cgroup_show(struct seq_file *m, struct pid_namespace *ns, struct pid *pid, struct task_struct *tsk); +struct audit_buffer; +void audit_cgroup_list(struct audit_buffer *ab); void cgroup_fork(struct task_struct *p); extern int cgroup_can_fork(struct task_struct *p); diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h index d820aa9..c1ae016 100644 --- a/include/uapi/linux/audit.h +++ b/include/uapi/linux/audit.h @@ -111,6 +111,8 @@ #define AUDIT_PROCTITLE 1327 /* Proctitle emit event */ #define AUDIT_FEATURE_CHANGE 1328 /* audit log listing feature changes */ #define AUDIT_REPLACE 1329 /* Replace auditd if this packet unanswerd */ +#define AUDIT_CAPABILITY 1330 /* Record showing capability use */ +#define AUDIT_CGROUP 1331 /* Record showing cgroups */ #define AUDIT_AVC 1400 /* SE Linux avc denial or grant */ #define AUDIT_SELINUX_ERR 1401 /* Internal SE Linux Errors */ diff --git a/kernel/audit.c b/kernel/audit.c index 8d528f9..98dd920 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -54,6 +54,7 @@ #include <linux/kthread.h> #include <linux/kernel.h> #include <linux/syscalls.h> +#include <linux/cgroup.h> #include <linux/audit.h> @@ -1682,7 +1683,7 @@ void audit_log_cap(struct audit_buffer *ab, char *prefix, kernel_cap_t *cap) { int i; - audit_log_format(ab, " %s=", prefix); + audit_log_format(ab, "%s=", prefix); CAP_FOR_EACH_U32(i) { audit_log_format(ab, "%08x", cap->cap[CAP_LAST_U32 - i]); @@ -1696,11 +1697,11 @@ static void audit_log_fcaps(struct audit_buffer *ab, struct audit_names *name) int log = 0; if (!cap_isclear(*perm)) { - audit_log_cap(ab, "cap_fp", perm); + audit_log_cap(ab, " cap_fp", perm); log = 1; } if (!cap_isclear(*inh)) { - audit_log_cap(ab, "cap_fi", inh); + audit_log_cap(ab, " cap_fi", inh); log = 1; } diff --git a/kernel/audit.h b/kernel/audit.h index a492f4c..680e8b5 100644 --- a/kernel/audit.h +++ b/kernel/audit.h @@ -202,6 +202,7 @@ struct audit_context { }; int fds[2]; struct audit_proctitle proctitle; + kernel_cap_t cap_used; }; extern u32 audit_ever_enabled; diff --git a/kernel/auditsc.c b/kernel/auditsc.c index 2672d10..32c3813 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -197,7 +197,6 @@ static int audit_match_filetype(struct audit_context *ctx, int val) * References in it _are_ dropped - at the same time we free/drop aux stuff. */ -#ifdef CONFIG_AUDIT_TREE static void audit_set_auditable(struct audit_context *ctx) { if (!ctx->prio) { @@ -206,6 +205,7 @@ static void audit_set_auditable(struct audit_context *ctx) } } +#ifdef CONFIG_AUDIT_TREE static int put_tree_ref(struct audit_context *ctx, struct audit_chunk *chunk) { struct audit_tree_refs *p = ctx->trees; @@ -1439,6 +1439,18 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts audit_log_proctitle(tsk, context); + ab = audit_log_start(context, GFP_KERNEL, AUDIT_CAPABILITY); + if (ab) { + audit_log_cap(ab, "cap_used", &context->cap_used); + audit_log_end(ab); + } + ab = audit_log_start(context, GFP_KERNEL, AUDIT_CGROUP); + if (ab) { + audit_log_format(ab, "cgroups="); + audit_cgroup_list(ab); + audit_log_end(ab); + } + /* Send end of event record to help user space know we are finished */ ab = audit_log_start(context, GFP_KERNEL, AUDIT_EOE); if (ab) @@ -2428,3 +2440,17 @@ struct list_head *audit_killed_trees(void) return NULL; return &ctx->killed_trees; } + +void audit_log_cap_use(int cap) +{ + struct audit_context *context = current->audit_context; + + if (context) { + cap_raise(context->cap_used, cap); + audit_set_auditable(context); + } else { + audit_log(NULL, GFP_NOFS, AUDIT_CAPABILITY, + "cap_used=%d pid=%d no audit_context", + cap, task_pid_nr(current)); + } +} diff --git a/kernel/capability.c b/kernel/capability.c index 45432b5..d45d5b1 100644 --- a/kernel/capability.c +++ b/kernel/capability.c @@ -366,8 +366,8 @@ bool has_capability_noaudit(struct task_struct *t, int cap) * @ns: The usernamespace we want the capability in * @cap: The capability to be tested for * - * Return true if the current task has the given superior capability currently - * available for use, false if not. + * Return true if the current task has the given superior capability + * currently available for use, false if not. Write an audit message. * * This sets PF_SUPERPRIV on the task if the capability is available on the * assumption that it's about to be used. @@ -380,6 +380,7 @@ bool ns_capable(struct user_namespace *ns, int cap) } if (security_capable(current_cred(), ns, cap) == 0) { + audit_log_cap_use(cap); current->flags |= PF_SUPERPRIV; return true; } diff --git a/kernel/cgroup.c b/kernel/cgroup.c index 75c0ff0..1931679 100644 --- a/kernel/cgroup.c +++ b/kernel/cgroup.c @@ -63,6 +63,7 @@ #include <linux/nsproxy.h> #include <linux/proc_ns.h> #include <net/sock.h> +#include <linux/audit.h> /* * pidlists linger the following amount before being destroyed. The goal @@ -5789,6 +5790,67 @@ out: return retval; } +/* + * audit_cgroup_list() + * - Print task's cgroup paths with audit_log_format() + * - Used for capability audit logging + * - Otherwise very similar to proc_cgroup_show(). + */ +void audit_cgroup_list(struct audit_buffer *ab) +{ + char *buf, *path; + struct cgroup_root *root; + + buf = kmalloc(PATH_MAX, GFP_NOFS); + if (!buf) + return; + + mutex_lock(&cgroup_mutex); + spin_lock_irq(&css_set_lock); + + for_each_root(root) { + struct cgroup_subsys *ss; + struct cgroup *cgrp; + int ssid, count = 0; + + if (root == &cgrp_dfl_root && !cgrp_dfl_visible) + continue; + + if (root != &cgrp_dfl_root) + for_each_subsys(ss, ssid) + if (root->subsys_mask & (1 << ssid)) + audit_log_format(ab, "%s%s", + count++ ? "," : "", + ss->legacy_name); + if (strlen(root->name)) + audit_log_format(ab, "%sname=%s", count ? "," : "", + root->name); + audit_log_format(ab, ":"); + + cgrp = task_cgroup_from_root(current, root); + + if (cgroup_on_dfl(cgrp) || !(current->flags & PF_EXITING)) { + path = cgroup_path_ns_locked(cgrp, buf, PATH_MAX, + current->nsproxy->cgroup_ns); + if (!path) + goto out_unlock; + } else + path = "/"; + + audit_log_format(ab, "%s", path); + + if (cgroup_on_dfl(cgrp) && cgroup_is_dead(cgrp)) + audit_log_format(ab, " (deleted);"); + else + audit_log_format(ab, ";"); + } + +out_unlock: + spin_unlock_irq(&css_set_lock); + mutex_unlock(&cgroup_mutex); + kfree(buf); +} + /* Display information about each subsystem and each hierarchy */ static int proc_cgroupstats_show(struct seq_file *m, void *v) { -- 2.8.1

9 years

5
13
0 / 0

Trivial patches

by Laurent Bigonville

Hi, Could you please merge the following patches that have been proposed to debian by Nicolas Braud-Santoni? The patches add the Documentation key in the .service file and also fix some typos. Cheers, Laurent Bigonville

9 years, 1 month

2
1
0 / 0

Upgrading audit package

by Bhagwat, Shriniketan Manjunath

Hi Steve, I am using audit in my development environment. My development environment is as below. RHEL 5.2 with kernel 2.6.32-431.el6.x86_64 and audit-2.2-2.el6.x86_64. SUSE 11 SP3 with kernel 3.0.76-0.11-default and audit-1.8-0.30.1 As I understand the above audit packages I am using in my environment are user space audit. I want to upgrade it to the latest version. If I upgrade the audit packages to latest version 2.6.X will there be any issues? Linux Audit kernel available with kernel 2.6.32-431.el6.x86_64 and 3.0.76-0.11 are compatible with user space audit 2.6.X? In your opinion what is the suitable audit package for my environment to upgrade? If these topics are already documented please guide me to the documentation. Regards, Ketan

9 years, 1 month

2
1
0 / 0

[PATCH 0/3] Misc build fixes

by Thomas Petazzoni

Hello, The first two patches in this series fix misc build issues of audit with old kernel headers. The last patch fixes warnings encountered when running autoreconf on audit's configure.ac. As a side note, are there any plans to switch the audit development to a Git repository? Having to switch back to Subversion is really painful, which is why the patches in this series are Git-formatted. Thanks! Thomas Thomas Petazzoni (3): lib/gen_tables.c: define EHWPOISON when not available Fix usage of audit_status.feature_bitmap configure.ac: add subdir-objects configure.ac | 3 ++- lib/gen_tables.c | 9 +++++++++ lib/libaudit.c | 2 +- 3 files changed, 12 insertions(+), 2 deletions(-) -- 2.7.4

9 years, 1 month

2
9
0 / 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Linux-audit July 2016