March 2017 - Linux-audit - Linux-Audit List Archives

by Laurent Bigonville

Le 30/03/17 à 15:56, cgzones a écrit : Hi, I just received the following bug in debian: > ausearch segfaults on the following input in interpret mode: > > /sbin/ausearch -i --input file > > type=AVC msg=audit(1490829425.686:121): avc: denied { bind } for > pid=1034 comm="darkstat" scontext=system_u:system_r:darkstat_t:s0 > tcontext=system_u:system_r:darkstat_t:s0 tclass=packet_socket > permissive=0 > type=SYSCALL msg=audit(1490829425.686:121): arch=c000003e syscall=49 > success=no exit=-13 a0=3 a1=7ffce52e04b0 a2=14 a3=373 items=0 > ppid=1033 pid=1034 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 > egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="darkstat" > exe="/usr/sbin/darkstat" subj=system_u:system_r:darkstat_t:s0 > key=(null) > type=SOCKADDR msg=audit(1490829425.686:121): > saddr=1100000302000000000000000000000000000000 > type=PROCTITLE msg=audit(1490829425.686:121): > proctitle=2F7573722F7362696E2F6461726B73746174002D6900656E70307333002D2D6368726F6F74002F7661722F6C69622F6461726B73746174002D2D70696466696C65002F7661722F72756E2F6461726B737461742E706964002D2D696D706F7274006461726B737461742E6462002D2D6578706F7274006461726B737461742E64 The user is running version 2.6.7 (the version that will be shipped in the upcoming stable release). I can actually reproduce the issue with the following one line: type=SOCKADDR msg=audit(1490829425.686:121): saddr=1100000302000000000000000000000000000000 I got the following stacktrace: #0 strlen () at ../sysdeps/x86_64/strlen.S:106 #1 0x00007ffff79a04da in auparse_do_interpretation (type=type@entry=9, id=id@entry=0x7fffffffde00) at ../../../auparse/interpret.c:2917 #2 0x000055555555d3f1 in interpret (rtype=1306, comma=0, val=0x555555771a93 "1100000302", '0' <repeats 30 times>, name=<optimized out>) at ../../../src/ausearch-report.c:359 #3 output_interpreted_node (n=0x555555771bd0, e=e@entry=0x555555771ae8) at ../../../src/ausearch-report.c:296 #4 0x000055555555d9e3 in output_interpreted (l=0x555555771ad0) at ../../../src/ausearch-report.c:151 #5 output_record (l=0x555555771ad0) at ../../../src/ausearch-report.c:80 #6 0x0000555555557cac in process_log_fd () at ../../../src/ausearch.c:445 #7 0x000055555555782b in main (argc=4, argv=0x7fffffffe098) at ../../../src/ausearch.c:140

7 years, 8 months

2
1
0 / 0

Auditd.conf settings for Satellite 6 server

by Fulda, Paul R [US] (MS)

All, Can someone give me some optimized auditd.conf settings for a Red Hat Satellite 6 server running on Red Hat 7.3? When I am creating and updating content views on satellite, auditd cannot keep up and bogs the system to a halt. The audit.rules file is configured for DISA security settings so it's looking at a lot of things. Any help would be much appreciated. Thanks, Paul Fulda

7 years, 8 months

2
1
0 / 0

Reboots and audit.rules

by warron.french

Steve, is there anyway that you know of both as the author of the Red Hat Audit software, and also an employee of Red Hat that would allow someone to review the audit logs and determine one of the following 2 possibilities: 1. If the machine was rebooted through software; such as; - poweroff, - shutdown, - init, etc.. etc.. 2. Or a person pressed the power button on the front of the machine. I ran into this problem in the workplace last year, and this feature would be helpful, but I don't know if it is already offered covering the power-button depression; versus the command execution. I understand that with a power-button depression there is no way of capturing the/a userid; perhaps a hidden default account of "power-button" would suffice? Thank you, -------------------------- Warron French

7 years, 8 months

3
2
0 / 0

audit 2.7.4 released

by Steve Grubb

Hello, I've just released a new version of the audit daemon. It can be downloaded from http://people.redhat.com/sgrubb/audit. It will also be in rawhide soon. The ChangeLog is: - Fix python3 byte compile for libaudit bindings - Add "boot" keyword to time parameters of ausearch/aureport - In auparse normalizer, add memory object kind - In auparse normalizer, handle a couple more file related syscalls - In auparse normalizer, find the object for AVC's - In ausearch/auparse mark KERNEL event as 1 record event - Bump up the default value of the audispd q_depth setting to 250 - In auparse, allow '-' in field names for ausearch_add_expression() - In auparse normalize, break change-file-attribute to permission and ownership - Add python bindings for auparse normalizer - Fix aureport's file report to not pick the parent path record in reports - Document auparse normalize accessor functions with a man page - In auparse normalizer, handle scheduler syscalls - In auparse normalizer, find path record for file syscalls without cwd record - Update the syscall table to the 4.11 kernel - Fix auvirt time keywords to work properly (#1367703) - In auditd, if any action is exec, close and reopen the logging descriptor This is a big release in terms of the number of updates made during the development cycle. Most of the items listed above are to round out the normalizer support as I tested different kinds of records. There are now python bindings for the auparse normalizer. Ausearch/report have a new time keyword, boot, which will use all events since the last boot. The libaudit syscall tables were updated for the new syscalls in the 4.11 linux kernel. It was discovered that in the event that there are multiple path records, aureport was outputting the first one in the file report which was most likely a directory. Now it will choose the first non-parent record and output it. The default q_depth setting for audispd was bumped up a little to prevent dropping events during bursts of activity. And in auditd, if you specify an exec action item, auditd will now close the logging descriptor so that the called program can do anything it wants to the audit files. The called script/program must send SIGUSR2 to auditd to resume logging. (This has always been the case and is not new.) When auditd sees SIGUSR2, it will resume logging by re-opening the old file or create new audit.log file as needed. This is the first release off of the github repo. There is a release listed on the project page. Its a raw release that has not been processed by automake/ autoconf. I will probably change the naming convention to distinguish raw github tar balls vs processed and ready to use tar balls. Please let me know if you run across any problems with this release. -Steve

7 years, 9 months

1
0
0 / 0

space_left_action=exec only works once?

by Bond Masuda

Hello, I configured space_left and space_left_action to run a script that compresses and moves older audit log files from /var/log/audit. It appears to work 1 time, and then doesn't work anymore until I kill the auditd daemon and start it again. Is this expected and/or desired behavior? I didn't see anything in the man pages about this behavior. I was hoping to have my script run every time the space_left threshold is hit so as to not run out of logging disk space. Is there something I can do to accomplish this? Thanks, Bond

7 years, 9 months

3
5
0 / 0

Full path of the filename not showing up in audit logs for some entries in aureport -f

by Kaptaan

Hello, I have set some file monitoring audit rules on a directory and the audit log shows some entries like ausearch -if $LOGDIR -a 448424 -i NOTE - using logs in /qdap01/tax/logs/audit.log ---- type=PATH msg=audit(02/27/2017 13:50:13.917:448424) : item=1 name=/qdap01/tax/data/seqfiles/DFS/PPDFA.PSCM1.TESTAK.GDG.tax.41.tmp1 inode=6581 dev=fd:33 mode=file,777 ouid=akatekar ogid=mfradmin rdev=00:00 nametype=CREATE type=PATH msg=audit(02/27/2017 13:50:13.917:448424) : item=0 name=/qdap01/tax/data/seqfiles/DFS/ inode=2 dev=fd:33 mode=dir,770 ouid=mfradmin ogid=mfradmin rdev=00:00 nametype=PARENT type=CWD msg=audit(02/27/2017 13:50:13.917:448424) : cwd=/qdap01/tax/users/akatekar/mbmwk/1488225013.635 type=SYSCALL msg=audit(02/27/2017 13:50:13.917:448424) : arch=i386 syscall=open success=yes exit=5 a0=0x8be40c0 a1=O_WRONLY|O_CREAT|O_TRUNC a2=0777 a3=0x0 items=2 ppid=635 pid=677 auid=rmoroncelli uid=akatekar gid=mfradmin euid=akatekar suid=akatekar fsuid=akatekar egid=mfradmin sgid=mfradmin fsgid=mfradmin tty=(none) ses=219531 comm=EXECPGM exe=/qdap01/tax/ebmnode/bpe12.7.9/public/utilm/EXECPGM key=DFS_DATA ausearch -if $LOGDIR -a 448424 --raw | aureport -i -f NOTE - using logs in /qdap01/tax/logs/audit.log File Report =============================================== # date time file syscall success exe auid event =============================================== 1. 02/27/2017 13:50:13 /qdap01/tax/data/seqfiles/DFS/ open yes /qdap01/tax/ebmnode/bpe12.7.9/public/utilm/EXECPGM rmoroncelli 448424 As you can see the full path of the file is available for the audit event, but yet the aureport -f does not show the complete file name. Any idea why this is happening and what should I do to get the full path as given in item1. It seems for some reason, it always gives the filename in item0. I have another entry where the inode is present but the name is (null). ausearch -if $LOGDIR -a 448425 -i NOTE - using logs in /qdap01/tax/logs/audit.log ---- type=PATH msg=audit(02/27/2017 13:50:14.862:448425) : item=1 name=(null) inode=6581 dev=fd:33 mode=file,777 ouid=akatekar ogid=mfradmin rdev=00:00 nametype=NORMAL type=PATH msg=audit(02/27/2017 13:50:14.862:448425) : item=0 name=/qdap01/tax/data/seqfiles/DFS/ inode=2 dev=fd:33 mode=dir,770 ouid=mfradmin ogid=mfradmin rdev=00:00 nametype=PARENT type=CWD msg=audit(02/27/2017 13:50:14.862:448425) : cwd=/qdap01/tax/users/akatekar/mbmwk/1488225013.635 type=SYSCALL msg=audit(02/27/2017 13:50:14.862:448425) : arch=i386 syscall=open success=yes exit=5 a0=0x914552a a1=O_WRONLY|O_CREAT|O_TRUNC a2=0777 a3=0x0 items=2 ppid=677 pid=803 auid=rmoroncelli uid=akatekar gid=mfradmin euid=akatekar suid=akatekar fsuid=akatekar egid=mfradmin sgid=mfradmin fsgid=mfradmin tty=(none) ses=219531 comm=IEBGENER exe=/qdap01/tax/ebmnode/bpe12.7.9/public/utilm/IEBGENER key=DFS_DATA ausearch -if $LOGDIR -a 448425 --raw | aureport -i -f NOTE - using logs in /qdap01/tax/logs/audit.log File Report =============================================== # date time file syscall success exe auid event =============================================== 1. 02/27/2017 13:50:14 /qdap01/tax/data/seqfiles/DFS/ open yes /qdap01/tax/ebmnode/bpe12.7.9/public/utilm/IEBGENER rmoroncelli 448425 Why is this coming as null for item1? Another entry has a rename SYSCALL, which comes out ausearch -if $LOGDIR -a 448427 -i NOTE - using logs in /qdap01/tax/logs/audit.log ---- type=PATH msg=audit(02/27/2017 13:50:14.939:448427) : item=3 name=/qdap01/tax/data/seqfiles/DFS/PPDFA.PSCM1.TESTAK.GDG_08 inode=6703 dev=fd:33 mode=file,777 ouid=akatekar ogid=mfradmin rdev=00:00 nametype=CREATE type=PATH msg=audit(02/27/2017 13:50:14.939:448427) : item=2 name=/qdap01/tax/data/seqfiles/DFS/PPDFA.PSCM1.TESTAK.GDG_07 inode=6703 dev=fd:33 mode=file,777 ouid=akatekar ogid=mfradmin rdev=00:00 nametype=DELETE type=PATH msg=audit(02/27/2017 13:50:14.939:448427) : item=1 name=/qdap01/tax/data/seqfiles/DFS/ inode=2 dev=fd:33 mode=dir,770 ouid=mfradmin ogid=mfradmin rdev=00:00 nametype=PARENT type=PATH msg=audit(02/27/2017 13:50:14.939:448427) : item=0 name=/qdap01/tax/data/seqfiles/DFS/ inode=2 dev=fd:33 mode=dir,770 ouid=mfradmin ogid=mfradmin rdev=00:00 nametype=PARENT type=CWD msg=audit(02/27/2017 13:50:14.939:448427) : cwd=/qdap01/tax/users/akatekar/mbmwk/1488225013.635 type=SYSCALL msg=audit(02/27/2017 13:50:14.939:448427) : arch=i386 syscall=rename success=yes exit=0 a0=0xfff3b160 a1=0xfff3ad60 a2=0x7 a3=0xfff3b160 items=4 ppid=840 pid=843 auid=rmoroncelli uid=akatekar gid=mfradmin euid=akatekar suid=akatekar fsuid=akatekar egid=mfradmin sgid=mfradmin fsgid=mfradmin tty=(none) ses=219531 comm=gdgen exe=/qdap01/tax/ebmnode/bpe12.7.9/public/utilm/gdgen key=DFS_DATA ausearch -if $LOGDIR -a 448427 -r | aureport -i -f NOTE - using logs in /qdap01/tax/logs/audit.log File Report =============================================== # date time file syscall success exe auid event =============================================== 1. 02/27/2017 13:50:14 /qdap01/tax/data/seqfiles/DFS/ rename yes /qdap01/tax/ebmnode/bpe12.7.9/public/utilm/gdgen rmoroncelli 448427 How can we get both the filenames (in item3 and item2) in the aureport? Finally, can we have uid come out in the aureport along with auid? Any option/arguments that might help? Sorry, if this has already been asked many times, but I did not get my answers with the limited search that I did. Thanks in advance for the help. Regards, Amit Katekar. Sent with [ProtonMail](https://protonmail.com) Secure Email.

7 years, 9 months

2
2
0 / 0

Audit fixes for v4.11 (#1)

by Paul Moore

Hi Linus, We've got an audit fix, and unfortunately it is two things I don't like: big and based on a -rcX tag. The size of the patch is (hopefully) explained well in the patch description, the -rcX base is to get access to code not present in the v4.11 pull request (audit/next is still based off v4.8; I'll be updating soon). While I'm not excited that we need to be sending you something this large during the -rcX phase, it does fix some very real, and very tangled, problems relating to locking, backlog queues, and the audit daemon connection. This code has passed our testsuite without problem and it has held up to my ad-hoc stress tests (arguably better than the existing code), please consider pulling this as fix for the next v4.11-rcX tag. Thanks, -Paul --- The following changes since commit 97da3854c526d3a6ee05c849c96e48d21527606c: Linux 4.11-rc3 (2017-03-19 19:09:39 -0700) are available in the git repository at: git://git.infradead.org/users/pcmoore/audit stable-4.11 for you to fetch changes up to 5b52330bbfe63b3305765354d6046c9f7f89c011: audit: fix auditd/kernel connection state tracking (2017-03-21 11:26:35 -0400) ---------------------------------------------------------------- Paul Moore (1): audit: fix auditd/kernel connection state tracking kernel/audit.c | 639 ++++++++++++++++++++++++++++++++++--------------------- kernel/audit.h | 9 +- kernel/auditsc.c | 6 +- 3 files changed, 399 insertions(+), 255 deletions(-) -- paul moore security @ redhat

7 years, 9 months

2
5
0 / 0

0324 tree BUG at kernel/auditsc.c:1513!

by Xiong Zhou

[11230.930568] ------------[ cut here ]------------ [11230.953828] kernel BUG at kernel/auditsc.c:1513! [11230.976157] invalid opcode: 0000 [#1] SMP [11230.995917] Modules linked in: btrfs xor raid6_pq ext2 dm_thin_pool dm_persistent_data dm_bio_prison dm_bufio loop ext4 jbd2 mbcache xt_CHECKSUM iptable_mangle ipt_MASQUERADE nf_nat_masquerade_ipv4 iptable_nat nf_nat_ipv4 nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack ipt_REJECT nf_reject_ipv4 tun bridge stp llc ebtable_filter ebtables ip6table_filter ip6_tables iptable_filter dm_mirror dm_region_hash dm_log dm_mod intel_rapl sb_edac edac_core x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel kvm irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcbc ipmi_ssif aesni_intel crypto_simd ipmi_si glue_helper iTCO_wdt ipmi_devintf iTCO_vendor_support cryptd dax_pmem sg hpilo ipmi_msghandler hpwdt lpc_ich pcc_cpufreq pcspkr dax ioatdma i2c_i801 wmi acpi_power_meter acpi_cpufreq [11231.318010] dca shpchp nfsd auth_rpcgss nfs_acl lockd grace sunrpc binfmt_misc ip_tables xfs libcrc32c sd_mod mgag200 i2c_algo_bit drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops ttm drm tg3 ptp hpsa crc32c_intel nd_pmem serio_raw i2c_core pps_core scsi_transport_sas [last unloaded: scsi_debug] [11231.440342] CPU: 24 PID: 15334 Comm: dio_truncate Not tainted 4.11.0-rc3-linux-next-65b2dc3-next-20170324 #336 [11231.488861] Hardware name: HP ProLiant DL360 Gen9, BIOS P89 05/06/2015 [11231.521003] task: ffff9eb578bc5a00 task.stack: ffffc277665d8000 [11231.547477] RIP: 0010:__audit_syscall_entry+0xf0/0x100 [11231.570495] RSP: 0018:ffffc277665dbe90 EFLAGS: 00010206 [11231.594551] RAX: 0000000000000000 RBX: ffff9ebf2896a800 RCX: 0000000000000000 [11231.626815] RDX: 0000000000004000 RSI: 00007ffe7a853c60 RDI: 0000000000000002 [11231.658965] RBP: ffffc277665dbea0 R08: 00007ffe7a853940 R09: ffff9eb578bc5a00 [11231.691211] R10: 00007ffe7a853940 R11: 00000000770b5a00 R12: 0000000000000000 [11231.723119] R13: 0000000000000002 R14: 0000000000000000 R15: 0000000000000000 [11231.755258] FS: 00007fdbdb18b740(0000) GS:ffff9ebf3fc00000(0000) knlGS:0000000000000000 [11231.791482] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [11231.817433] CR2: 00007fff02451000 CR3: 0000000760820000 CR4: 00000000001406e0 [11231.849728] Call Trace: [11231.860748] syscall_trace_enter+0x1d0/0x2b0 [11231.880034] ? __audit_syscall_exit+0x209/0x290 [11231.900057] do_syscall_64+0x155/0x180 [11231.916776] entry_SYSCALL64_slow_path+0x25/0x25 [11231.937440] RIP: 0033:0x7fdbdad70c20 [11231.953513] RSP: 002b:00007ffe7a853c28 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [11231.989037] RAX: ffffffffffffffda RBX: 00007fdbdb18b6c0 RCX: 00007fdbdad70c20 [11232.023770] RDX: 0000000000000000 RSI: 0000000000004000 RDI: 00007ffe7a853c60 [11232.059308] RBP: 00007ffe7a853c60 R08: 0000000000000000 R09: 0000000001a68010 [11232.091419] R10: 00007ffe7a853940 R11: 0000000000000246 R12: 00000000ffffffff [11232.123493] R13: 00007ffe7a854d50 R14: 0000000000000000 R15: 0000000000000000 [11232.155457] Code: 02 00 00 00 00 00 00 5b 41 5c 5d c3 48 c7 43 50 00 00 00 00 48 c7 c2 a0 f8 6f a6 48 89 de 4c 89 cf e8 05 f5 ff ff 41 89 c4 eb a9 <0f> 0b 0f 1f 40 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 [11232.240315] RIP: __audit_syscall_entry+0xf0/0x100 RSP: ffffc277665dbe90 [11232.272441] BUG: unable to handle kernel paging request at ffff9ebf29362000 [11232.272451] ---[ end trace 7e25ab22dc4e0f7a ]--- [11232.273486] Kernel panic - not syncing: Fatal exception [11232.347746] IP: __memmove+0x24/0x1a0 [11232.363684] PGD 7362e1067 [11232.363684] P4D 7362e1067 [11232.375799] PUD 107243f063 [11232.387851] PMD 1069361063 [11232.400372] BAD [11232.422587] Oops: 0002 [#2] SMP [11232.436808] Modules linked in: btrfs xor raid6_pq ext2 dm_thin_pool dm_persistent_data dm_bio_prison dm_bufio loop ext4 jbd2 mbcache xt_CHECKSUM iptable_mangle ipt_MASQUERADE nf_nat_masquerade_ipv4 iptable_nat nf_nat_ipv4 nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack ipt_REJECT nf_reject_ipv4 tun bridge stp llc ebtable_filter ebtables ip6table_filter ip6_tables iptable_filter dm_mirror dm_region_hash dm_log dm_mod intel_rapl sb_edac edac_core x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel kvm irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcbc ipmi_ssif aesni_intel crypto_simd ipmi_si glue_helper iTCO_wdt ipmi_devintf iTCO_vendor_support cryptd dax_pmem sg hpilo ipmi_msghandler hpwdt lpc_ich pcc_cpufreq pcspkr dax ioatdma i2c_i801 wmi acpi_power_meter acpi_cpufreq [11232.793787] dca shpchp nfsd auth_rpcgss nfs_acl lockd grace sunrpc binfmt_misc ip_tables xfs libcrc32c sd_mod mgag200 i2c_algo_bit drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops ttm drm tg3 ptp hpsa crc32c_intel nd_pmem serio_raw i2c_core pps_core scsi_transport_sas [last unloaded: scsi_debug] [11232.920032] CPU: 19 PID: 15333 Comm: dio_truncate Tainted: G D 4.11.0-rc3-linux-next-65b2dc3-next-20170324 #336 [11232.972689] Hardware name: HP ProLiant DL360 Gen9, BIOS P89 05/06/2015 [11233.002856] task: ffff9ebf34519680 task.stack: ffffc2776d3f4000 [11233.030440] RIP: 0010:__memmove+0x24/0x1a0 [11233.050212] RSP: 0018:ffffc2776d3f78a8 EFLAGS: 00010287 [11233.075431] RAX: ffff9ebf28944920 RBX: 0000000000000000 RCX: ffffffffff5e2040 [11233.109644] RDX: fffffffffffff720 RSI: ffff9ebf29361ff8 RDI: ffff9ebf29362000 [11233.144389] RBP: ffffc2776d3f78b0 R08: ffff9ebf28944038 R09: 0000000000000000 [11233.178504] R10: 00000001166159f0 R11: 0000000000000000 R12: ffffc2776d3f79ac [11233.211975] R13: ffff9ebf28944000 R14: 0000000000000000 R15: ffff9ebf298733f0 [11233.245237] FS: 00007fdbdb18b740(0000) GS:ffff9eb623cc0000(0000) knlGS:0000000000000000 [11233.282453] CS: 0010 DS: 0000 ES: 000[11233.304930] Shutting down cpus with NMI [11233.304940] Kernel Offset: 0x24a00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) [11233.378481] ---[ end Kernel panic - not syncing: Fatal exception

7 years, 9 months

2
1
0 / 0

[ANNOUNCE] Linux Security Summit 2017 - CFP

by James Morris

============================================================================== ANNOUNCEMENT AND CALL FOR PARTICIPATION LINUX SECURITY SUMMIT 2017 14-15 September LOS ANGELES, USA ============================================================================== DESCRIPTION The Linux Security Summit (LSS) is a technical forum for collaboration between Linux developers, researchers, and end users. Its primary aim is to foster community efforts in analyzing and solving Linux security challenges. LSS this year will be co-located with the Open Source Summit and the Linux Plumbers Conference. The program committee currently seeks proposals for: * Refereed Presentations: 45 minutes in length, including at least 10 minutes of discussion. * Discussion Topics: 30 minutes in length. Topic areas include, but are not limited to: * Kernel self-protection * Access control * Cryptography and key management * Integrity control * Hardware Security * Iot and embedded security * Virtualization and containers * System-specific system hardening * Case studies * Security tools * Security UX * Emerging technologies, threats & techniques Proposals should be submitted via: http://events.linuxfoundation.org/events/linux-security-summit/program/cfp DATES * CFP Close: June 5, 2017 * CFP Notifications: June 12, 2017 * Schedule Announced: June 19, 2017 * Slide Submission: August 31, 2017 WHO SHOULD ATTEND We're seeking a diverse range of attendees, and welcome participation by people involved in Linux security development, operations, and research. The LSS is a unique global event which provides the opportunity to present and discuss your work or research with key Linux security community members and maintainers. It’s also useful for those who wish to keep up with the latest in Linux security development, and to provide input to the development process. WEB SITE http://events.linuxfoundation.org/events/linux-security-summit TWITTER For event updates and announcements, follow: https://twitter.com/LinuxSecSummit PROGRAM COMMITTEE The program committee for LSS 2017 is: * James Morris, Oracle * Serge Hallyn, Canonical * Paul Moore, Red Hat * Stephen Smalley, NSA * Elena Reshetova, Intel * John Johansen, Canonical * Kees Cook, Google * Casey Schaufler, Intel * Mimi Zohar, IBM * David A. Wheeler, Institute for Defense Analyses The program committee may be contacted as a group via email: lss-pc () lists.linuxfoundation.org

7 years, 9 months

1
0
0 / 0

[PATCH V4 1/2] netfilter: xt_AUDIT: use consistent ipv4 network offset

by Richard Guy Briggs

Even though the skb->data pointer has been moved from the link layer header to the network layer header, use the same method to calculate the offset in ipv4 and ipv6 routines. Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com> --- net/netfilter/xt_AUDIT.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/net/netfilter/xt_AUDIT.c b/net/netfilter/xt_AUDIT.c index 4973cbd..cdb7cee 100644 --- a/net/netfilter/xt_AUDIT.c +++ b/net/netfilter/xt_AUDIT.c @@ -76,7 +76,7 @@ static void audit_ip4(struct audit_buffer *ab, struct sk_buff *skb) struct iphdr _iph; const struct iphdr *ih; - ih = skb_header_pointer(skb, 0, sizeof(_iph), &_iph); + ih = skb_header_pointer(skb, skb_network_offset(skb), sizeof(_iph), &_iph); if (!ih) { audit_log_format(ab, " truncated=1"); return; -- 1.7.1

7 years, 9 months

3
6
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Linux-audit March 2017