June 2018 - Linux-audit - Linux-Audit List Archives

by Maupertuis Philippe

Hi, Being subject to the PCI DSS standard, I implemented the proposed audit rules for PCI, albeit slightly changed because we are still using NTP instead of Chrony. On a handful of vmware servers I have noticed that the clock_settime is used every fifteen minutes. These servers seem to have higher values than other for offset and jitter due to a heavy load on a firewall. These regular messages prevent us to have an automatic analysis of the event generated by the key 10.4.2b-time-change which we are required to do. If I add a rule to monitor /etc/ntp.conf, would it be safe to ignore them if the auid is unset and the uid ntp ? Below are the event I am seeing. node=xxxxxxxx type=PROCTITLE msg=audit(08/06/18 01:58:58.525:175718) : proctitle=/usr/sbin/ntpd -u ntp:ntp -g node=xxxxxxxx type=SYSCALL msg=audit(08/06/18 01:58:58.525:175718) : arch=x86_64 syscall=clock_settime success=yes exit=0 a0=CLOCK_REALTIME a1=0x7ffcba67b950 a2=0xb62c3 a3=0x4000 items=0 ppid=1 pid=819 auid=unset uid=ntp gid=ntp euid=ntp suid=ntp fsuid=ntp egid=ntp sgid=ntp fsgid=ntp tty=(none) ses=unset comm=ntpd exe=/usr/sbin/ntpd key=10.4.2b-time-change ---- node=xxxxxxxx type=PROCTITLE msg=audit(08/06/18 02:14:01.746:175775) : proctitle=/usr/sbin/ntpd -u ntp:ntp -g node=xxxxxxxx type=SYSCALL msg=audit(08/06/18 02:14:01.746:175775) : arch=x86_64 syscall=clock_settime success=yes exit=0 a0=CLOCK_REALTIME a1=0x7ffcba67b950 a2=0xec457 a3=0x4000 items=0 ppid=1 pid=819 auid=unset uid=ntp gid=ntp euid=ntp suid=ntp fsuid=ntp egid=ntp sgid=ntp fsgid=ntp tty=(none) ses=unset comm=ntpd exe=/usr/sbin/ntpd key=10.4.2b-time-change ---- node=xxxxxxxx type=PROCTITLE msg=audit(08/06/18 02:30:29.973:175847) : proctitle=/usr/sbin/ntpd -u ntp:ntp -g node=xxxxxxxx type=SYSCALL msg=audit(08/06/18 02:30:29.973:175847) : arch=x86_64 syscall=clock_settime success=yes exit=0 a0=CLOCK_REALTIME a1=0x7ffcba67b950 a2=0x2fab6 a3=0x4000 items=0 ppid=1 pid=819 auid=unset uid=ntp gid=ntp euid=ntp suid=ntp fsuid=ntp egid=ntp sgid=ntp fsgid=ntp tty=(none) ses=unset comm=ntpd exe=/usr/sbin/ntpd key=10.4.2b-time-change Thank you for advising on this. Philippe !!!************************************************************************************* "Ce message et les pi?ces jointes sont confidentiels et r?serv?s ? l'usage exclusif de ses destinataires. Il peut ?galement ?tre prot?g? par le secret professionnel. Si vous recevez ce message par erreur, merci d'en avertir imm?diatement l'exp?diteur et de le d?truire. L'int?grit? du message ne pouvant ?tre assur?e sur Internet, la responsabilit? de Worldline ne pourra ?tre recherch?e quant au contenu de ce message. Bien que les meilleurs efforts soient faits pour maintenir cette transmission exempte de tout virus, l'exp?diteur ne donne aucune garantie ? cet ?gard et sa responsabilit? ne saurait ?tre recherch?e pour tout dommage r?sultant d'un virus transmis. This e-mail and the documents attached are confidential and intended solely for the addressee; it may also be privileged. If you receive this e-mail in error, please notify the sender immediately and destroy it. As its integrity cannot be secured on the Internet, the Worldline liability cannot be triggered for the message content. Although the sender endeavours to maintain a computer virus-free network, the sender does not warrant that this transmission is virus-free and will not be liable for any damages resulting from any virus transmitted.!!!"

7 years

1
0
0 / 0

[PATCH] audit-testsuite: add nmap-ncat/netcat as a dependency

by Paul Moore

From: Paul Moore <paul(a)paul-moore.com> Required by the netfilter_pkt test. Signed-off-by: Paul Moore <paul(a)paul-moore.com> --- README.md | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 23fc23b..625a684 100644 --- a/README.md +++ b/README.md @@ -32,7 +32,8 @@ please follow the instructions below. perl-Test \ perl-Test-Harness \ perl-File-Which \ - perl-Time-HiRes + perl-Time-HiRes \ + nmap-ncat ### Fedora @@ -44,14 +45,16 @@ please follow the instructions below. perl-Test \ perl-Test-Harness \ perl-File-Which \ - perl-Time-HiRes + perl-Time-HiRes \ + nmap-ncat ### Debian Based Systems # apt-get install auditd \ build-essential \ libc6-i386 \ - perl-modules + perl-modules \ + netcat ## Execution

7 years

3
2
0 / 0

Missing "nametype" field in audit PATH records

by Nimrod Ostrovsky

Hello, I use the latest audit-userspace version on kernel 3.0.21, and Im trying to compile a dispatcher app for audispd. The problem is that PATH records does not have the "nametype" field in in this kernel version, and I want to be able to distinct between "parent" PATH records and any other types. Any ideas how to solve this issue? (Without having to upgrade the kernel) Cheers, Nimrod. -- <https://automotive.knect365.com/tu-auto-detroit/registration>

7 years

2
1
0 / 0

[PATCH ghau51/ghau40 v3 0/6] add support for audit container identifier

by Richard Guy Briggs

Add support for audit kernel container identifiers to userspace tools. The first and second add new record types. The third adds filter support. The fourth and 5th start to add search support. The last is intended for debugging and not for upstream. See: https://github.com/linux-audit/audit-userspace/issues/51 See: https://github.com/linux-audit/audit-userspace/issues/40 See: https://github.com/linux-audit/audit-kernel/issues/90 See: https://github.com/linux-audit/audit-kernel/issues/91 See: https://github.com/linux-audit/audit-testsuite/issues/64 See: https://github.com/linux-audit/audit-kernel/wiki/RFE-Audit-Container-ID Richard Guy Briggs (6): AUDIT_CONTAINER_ID message type basic support AUDIT_CONTAINER message type basic support auditctl: add support for AUDIT_CONTID filter add ausearch containerid support start normalization containerid support libaudit: add support to get the task audit container identifier auparse/normalize_record_map.h | 1 + docs/Makefile.am | 2 +- docs/audit_get_containerid.3 | 25 ++++++ docs/auditctl.8 | 3 + lib/fieldtab.h | 1 + lib/libaudit.c | 65 ++++++++++++++ lib/libaudit.h | 16 ++++ lib/msg_typetab.h | 2 + lib/netlink.c | 1 + src/auditctl-listing.c | 21 +++++ src/aureport-options.c | 1 + src/ausearch-llist.c | 2 + src/ausearch-llist.h | 1 + src/ausearch-match.c | 3 + src/ausearch-options.c | 47 +++++++++- src/ausearch-options.h | 1 + src/ausearch-parse.c | 199 +++++++++++++++++++++++++++++++++++++++++ 17 files changed, 389 insertions(+), 2 deletions(-) create mode 100644 docs/audit_get_containerid.3 -- 1.8.3.1

7 years

1
6
0 / 0

[PATCH v3 0/4] IMA: work on audit records produced by IMA

by Stefan Berger

This series of patches cleans up some usages of the audit subsystem's API by IMA. We also introduce a new record type that IMA creates while parsing policy rules. Stefan v2->v3: - reworked patch 4; pass current->audit_context rather than NULL v1->v2: - dropped several patches that extended existing messages with missing fields - Using audit_log_task_info() for new record type in last patch - rebased on security-next; new message type is now 1807 Stefan Berger (4): ima: Call audit_log_string() rather than logging it untrusted ima: Use audit_log_format() rather than audit_log_string() ima: Do not audit if CONFIG_INTEGRITY_AUDIT is not set ima: Differentiate auditing policy rules from "audit" actions include/uapi/linux/audit.h | 1 + security/integrity/ima/Kconfig | 1 + security/integrity/ima/ima_policy.c | 9 ++++++--- security/integrity/integrity.h | 15 +++++++++++++++ security/integrity/integrity_audit.c | 6 +----- 5 files changed, 24 insertions(+), 8 deletions(-) -- 2.13.6

7 years

3
9
0 / 0

[GIT PULL] Audit patches for v4.18

by Paul Moore

Hi Linus, Another reasonable chunk of audit changes for v4.18, thirteen patches in total. The thirteen patches can mostly be broken down into one of four categories: general bug fixes, accessor functions for audit state stored in the task_struct, negative filter matches on executable names, and extending the (relatively) new seccomp logging knobs to the audit subsystem. The main driver for the accessor functions from Richard are the changes we're working on to associate audit events with containers, but I think they have some standalone value too so I figured it would be good to get them in now. The seccomp/audit patches from Tyler apply the seccomp logging improvements from a few releases ago to audit's seccomp logging; starting with this patchset the changes in /proc/sys/kernel/seccomp/actions_logged should apply to both the standard kernel logging and audit. As usual, everything passes the audit-testsuite and it happens to merge cleanly with your tree. Please pull, thanks. -Paul -- The following changes since commit 60cc43fc888428bb2f18f08997432d426a243338: Linux 4.17-rc1 (2018-04-15 18:24:20 -0700) are available in the Git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit.git tags/audit-pr-20180605 for you to fetch changes up to 5b71388663c0920848c0ee7de946970a2692b76d: audit: Fix wrong task in comparison of session ID (2018-05-21 14:27:43 -0400) ---------------------------------------------------------------- audit/stable-4.18 PR 20180605 ---------------------------------------------------------------- Ondrej Mosnáček (2): audit: allow not equal op for audit by executable audit: Fix wrong task in comparison of session ID Richard Guy Briggs (7): audit: add syscall information to FEATURE_CHANGE records audit: convert sessionid unset to a macro audit: use inline function to get audit context audit: use inline function to set audit context audit: use new audit_context access funciton for seccomp_actions_logged audit: normalize loginuid read access audit: use existing session info function Tyler Hicks (4): seccomp: Separate read and write code for actions_logged sysctl seccomp: Configurable separator for the actions_logged string seccomp: Audit attempts to modify the actions_logged sysctl seccomp: Don't special case audited processes when logging Documentation/userspace-api/seccomp_filter.rst | 7 -- include/linux/audit.h | 39 ++++--- include/net/xfrm.h | 4 +- include/uapi/linux/audit.h | 1 + init/init_task.c | 3 +- kernel/audit.c | 6 +- kernel/audit_watch.c | 2 +- kernel/auditfilter.c | 6 +- kernel/auditsc.c | 135 ++++++++++++++++--------- kernel/fork.c | 2 +- kernel/seccomp.c | 126 ++++++++++++++++------- net/bridge/netfilter/ebtables.c | 2 +- net/core/dev.c | 18 ++-- net/netfilter/x_tables.c | 2 +- net/netlabel/netlabel_user.c | 2 +- security/integrity/ima/ima_api.c | 2 +- security/integrity/integrity_audit.c | 2 +- security/lsm_audit.c | 2 +- security/selinux/hooks.c | 7 +- security/selinux/selinuxfs.c | 6 +- security/selinux/ss/services.c | 12 +-- 21 files changed, 242 insertions(+), 144 deletions(-) -- paul moore www.paul-moore.com

7 years

1
0
0 / 0

[RFC PATCH ghak86 V1] audit: use audit_enabled as a boolean where convenient

by Richard Guy Briggs

Most uses of audit_enabled don't care about the distinction between AUDIT_ON and AUDIT_LOCKED, so using audit_enabled as a boolean makes more sense and is easier to read. Most uses of audit_enabled treat it as a boolean, so switch the remaining AUDIT_OFF usage to simply use audit_enabled as a boolean where applicable. See: https://github.com/linux-audit/audit-kernel/issues/86 Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com> --- drivers/tty/tty_audit.c | 2 +- include/net/xfrm.h | 2 +- kernel/audit.c | 8 ++++---- net/netfilter/xt_AUDIT.c | 2 +- net/netlabel/netlabel_user.c | 2 +- 5 files changed, 8 insertions(+), 8 deletions(-) diff --git a/drivers/tty/tty_audit.c b/drivers/tty/tty_audit.c index e30aa6b..1e48051 100644 --- a/drivers/tty/tty_audit.c +++ b/drivers/tty/tty_audit.c @@ -92,7 +92,7 @@ static void tty_audit_buf_push(struct tty_audit_buf *buf) { if (buf->valid == 0) return; - if (audit_enabled == 0) { + if (!audit_enabled) { buf->valid = 0; return; } diff --git a/include/net/xfrm.h b/include/net/xfrm.h index 7f2e31a..380542b 100644 --- a/include/net/xfrm.h +++ b/include/net/xfrm.h @@ -734,7 +734,7 @@ static inline struct audit_buffer *xfrm_audit_start(const char *op) { struct audit_buffer *audit_buf = NULL; - if (audit_enabled == 0) + if (!audit_enabled) return NULL; audit_buf = audit_log_start(audit_context(), GFP_ATOMIC, AUDIT_MAC_IPSEC_EVENT); diff --git a/kernel/audit.c b/kernel/audit.c index e7478cb..3a18e59 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -424,7 +424,7 @@ static int audit_do_config_change(char *function_name, u32 *to_change, u32 new) else allow_changes = 1; - if (audit_enabled != AUDIT_OFF) { + if (audit_enabled) { rc = audit_log_config_change(function_name, new, old, allow_changes); if (rc) allow_changes = 0; @@ -1097,7 +1097,7 @@ static void audit_log_feature_change(int which, u32 old_feature, u32 new_feature { struct audit_buffer *ab; - if (audit_enabled == AUDIT_OFF) + if (!audit_enabled) return; ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_FEATURE_CHANGE); if (!ab) @@ -1270,7 +1270,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh) err = auditd_set(req_pid, NETLINK_CB(skb).portid, sock_net(NETLINK_CB(skb).sk)); - if (audit_enabled != AUDIT_OFF) + if (audit_enabled) audit_log_config_change("audit_pid", new_pid, auditd_pid, @@ -1281,7 +1281,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh) /* try to process any backlog */ wake_up_interruptible(&kauditd_wait); } else { - if (audit_enabled != AUDIT_OFF) + if (audit_enabled) audit_log_config_change("audit_pid", new_pid, auditd_pid, 1); diff --git a/net/netfilter/xt_AUDIT.c b/net/netfilter/xt_AUDIT.c index f368ee6..3921553 100644 --- a/net/netfilter/xt_AUDIT.c +++ b/net/netfilter/xt_AUDIT.c @@ -72,7 +72,7 @@ static bool audit_ip6(struct audit_buffer *ab, struct sk_buff *skb) struct audit_buffer *ab; int fam = -1; - if (audit_enabled == 0) + if (!audit_enabled) goto errout; ab = audit_log_start(NULL, GFP_ATOMIC, AUDIT_NETFILTER_PKT); if (ab == NULL) diff --git a/net/netlabel/netlabel_user.c b/net/netlabel/netlabel_user.c index 2f328af..e68fa9d 100644 --- a/net/netlabel/netlabel_user.c +++ b/net/netlabel/netlabel_user.c @@ -101,7 +101,7 @@ struct audit_buffer *netlbl_audit_start_common(int type, char *secctx; u32 secctx_len; - if (audit_enabled == 0) + if (!audit_enabled) return NULL; audit_buf = audit_log_start(audit_context(), GFP_ATOMIC, type); -- 1.8.3.1

7 years

2
5
0 / 0

Auditd syslog plugin

by Boyce, Kevin P [US] (AS)

All, After enabling the syslog plugin for audispd and sending logs to a remote server I am seeing every event being written to /var/log/messages locally which is filling up /var. This is all redundant since local audit logs are kept in /var/log/audit. Is there a way to prevent auditd syslog plugin from writing to /var/log/messages? Thanks, Kevin

7 years

3
2
0 / 0

[PATCH ghak89 V2] audit: rename FILTER_TYPE to FILTER_EXCLUDE

by Richard Guy Briggs

The AUDIT_FILTER_TYPE name is vague and misleading due to not describing where or when the filter is applied and obsolete due to its available filter fields having been expanded. Userspace has already renamed it from AUDIT_FILTER_TYPE to AUDIT_FILTER_EXCLUDE without checking if it already exists. The userspace maintainer assures that as long as it is set to the same value it will not be a problem since the userspace code does not treat compiler warnings as errors. If this policy changes then checks if it already exists can be added at the same time. See: https://github.com/linux-audit/audit-kernel/issues/89 Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com> --- v2: - Change from AUDIT_FILTER_EXCL to AUDIT_FILTER_EXCLUDE --- include/uapi/linux/audit.h | 3 ++- kernel/audit.c | 2 +- kernel/auditfilter.c | 10 +++++----- 3 files changed, 8 insertions(+), 7 deletions(-) diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h index 04f9bd2..2678422 100644 --- a/include/uapi/linux/audit.h +++ b/include/uapi/linux/audit.h @@ -156,8 +156,9 @@ #define AUDIT_FILTER_ENTRY 0x02 /* Apply rule at syscall entry */ #define AUDIT_FILTER_WATCH 0x03 /* Apply rule to file system watches */ #define AUDIT_FILTER_EXIT 0x04 /* Apply rule at syscall exit */ -#define AUDIT_FILTER_TYPE 0x05 /* Apply rule at audit_log_start */ +#define AUDIT_FILTER_EXCLUDE 0x05 /* Apply rule at audit_log_start */ #define AUDIT_FILTER_FS 0x06 /* Apply rule at __audit_inode_child */ +#define AUDIT_FILTER_TYPE AUDIT_FILTER_EXCLUDE /* obsolete misleading naming */ #define AUDIT_NR_FILTERS 7 diff --git a/kernel/audit.c b/kernel/audit.c index 3a18e59..513a10e 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -1754,7 +1754,7 @@ struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask, if (audit_initialized != AUDIT_INITIALIZED) return NULL; - if (unlikely(!audit_filter(type, AUDIT_FILTER_TYPE))) + if (unlikely(!audit_filter(type, AUDIT_FILTER_EXCLUDE))) return NULL; /* NOTE: don't ever fail/sleep on these two conditions: diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c index eaa3201..261843d 100644 --- a/kernel/auditfilter.c +++ b/kernel/auditfilter.c @@ -264,7 +264,7 @@ static inline struct audit_entry *audit_to_entry_common(struct audit_rule_data * case AUDIT_FILTER_TASK: #endif case AUDIT_FILTER_USER: - case AUDIT_FILTER_TYPE: + case AUDIT_FILTER_EXCLUDE: case AUDIT_FILTER_FS: ; } @@ -337,7 +337,7 @@ static int audit_field_valid(struct audit_entry *entry, struct audit_field *f) { switch(f->type) { case AUDIT_MSGTYPE: - if (entry->rule.listnr != AUDIT_FILTER_TYPE && + if (entry->rule.listnr != AUDIT_FILTER_EXCLUDE && entry->rule.listnr != AUDIT_FILTER_USER) return -EINVAL; break; @@ -931,7 +931,7 @@ static inline int audit_add_rule(struct audit_entry *entry) /* If any of these, don't count towards total */ switch(entry->rule.listnr) { case AUDIT_FILTER_USER: - case AUDIT_FILTER_TYPE: + case AUDIT_FILTER_EXCLUDE: case AUDIT_FILTER_FS: dont_count = 1; } @@ -1013,7 +1013,7 @@ int audit_del_rule(struct audit_entry *entry) /* If any of these, don't count towards total */ switch(entry->rule.listnr) { case AUDIT_FILTER_USER: - case AUDIT_FILTER_TYPE: + case AUDIT_FILTER_EXCLUDE: case AUDIT_FILTER_FS: dont_count = 1; } @@ -1369,7 +1369,7 @@ int audit_filter(int msgtype, unsigned int listtype) break; } if (result > 0) { - if (e->rule.action == AUDIT_NEVER || listtype == AUDIT_FILTER_TYPE) + if (e->rule.action == AUDIT_NEVER || listtype == AUDIT_FILTER_EXCLUDE) ret = 0; break; } -- 1.8.3.1

7 years

2
1
0 / 0

[RFC PATCH ghak32 V2 00/13] audit: implement container id

by Richard Guy Briggs

Implement audit kernel container ID. This patchset is a second RFC based on the proposal document (V3) posted: https://www.redhat.com/archives/linux-audit/2018-January/msg00014.html The first patch implements the proc fs write to set the audit container ID of a process, emitting an AUDIT_CONTAINER record to announce the registration of that container ID on that process. This patch requires userspace support for record acceptance and proper type display. The second checks for children or co-threads and refuses to set the container ID if either are present. (This policy could be changed to set both with the same container ID provided they meet the rest of the requirements.) The third implements the auxiliary record AUDIT_CONTAINER_INFO if a container ID is identifiable with an event. This patch requires userspace support for proper type display. The fourth adds container ID filtering to the exit, exclude and user lists. This patch requires auditctil userspace support for the --containerid option. The 5th adds signal and ptrace support. The 6th creates a local audit context to be able to bind a standalone record with a locally created auxiliary record. The 7th, 8th, 9th, 10th patches add container ID records to standalone records. Some of these may end up being syscall auxiliary records and won't need this specific support since they'll be supported via syscalls. The 11th adds network namespace container ID labelling based on member tasks' container ID labels. The 12th adds container ID support to standalone netfilter records that don't have a task context and lists each container to which that net namespace belongs. The 13th implements reading the container ID from the proc filesystem for debugging. This patch isn't planned for upstream inclusion. Feedback please! Example: Set a container ID of 123456 to the "sleep" task: sleep 2& child=$! echo 123456 > /proc/$child/containerid; echo $? ausearch -ts recent -m container echo child:$child contid:$( cat /proc/$child/containerid) This should produce a record such as: type=CONTAINER msg=audit(1521122590.315:222): op=set pid=689 uid=0 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 auid=0 tty=pts0 ses=3 opid=707 old-contid=18446744073709551615 contid=123456 res=1 Example: Set a filter on a container ID 123459 on /tmp/tmpcontainerid: containerid=123459 key=tmpcontainerid auditctl -a exit,always -F dir=/tmp -F perm=wa -F containerid=$containerid -F key=$key perl -e "sleep 1; open(my \$tmpfile, '>', \"/tmp/$key\"); close(\$tmpfile);" & child=$! echo $containerid > /proc/$child/containerid sleep 2 ausearch -i -ts recent -k $key auditctl -d exit,always -F dir=/tmp -F perm=wa -F containerid=$containerid -F key=$key rm -f /tmp/$key This should produce an event such as: type=CONTAINER_INFO msg=audit(1521122591.614:227): op=task contid=123459 type=PROCTITLE msg=audit(1521122591.614:227): proctitle=7065726C002D6500736C65657020313B206F70656E286D792024746D7066696C652C20273E272C20222F746D702F746D70636F6E7461696E6572696422293B20636C6F73652824746D7066696C65293B type=PATH msg=audit(1521122591.614:227): item=1 name="/tmp/tmpcontainerid" inode=18427 dev=00:26 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:user_tmp_t:s0 nametype=CREATE cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0 type=PATH msg=audit(1521122591.614:227): item=0 name="/tmp/" inode=13513 dev=00:26 mode=041777 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:tmp_t:s0 nametype=PARENT cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0 type=CWD msg=audit(1521122591.614:227): cwd="/root" type=SYSCALL msg=audit(1521122591.614:227): arch=c000003e syscall=257 success=yes exit=3 a0=ffffffffffffff9c a1=55db90a28900 a2=241 a3=1b6 items=2 ppid=689 pid=724 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="perl" exe="/usr/bin/perl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="tmpcontainerid" See: https://github.com/linux-audit/audit-kernel/issues/32 https://github.com/linux-audit/audit-userspace/issues/40 https://github.com/linux-audit/audit-testsuite/issues/64 Richard Guy Briggs (13): audit: add container id audit: check children and threading before allowing containerid audit: log container info of syscalls audit: add containerid filtering audit: add containerid support for ptrace and signals audit: add support for non-syscall auxiliary records audit: add container aux record to watch/tree/mark audit: add containerid support for tty_audit audit: add containerid support for config/feature/user records audit: add containerid support for seccomp and anom_abend records audit: add support for containerid to network namespaces audit: NETFILTER_PKT: record each container ID associated with a netNS debug audit: read container ID of a process drivers/tty/tty_audit.c | 5 +- fs/proc/base.c | 53 ++++++++++++++++ include/linux/audit.h | 43 +++++++++++++ include/linux/init_task.h | 4 +- include/linux/sched.h | 1 + include/net/net_namespace.h | 12 ++++ include/uapi/linux/audit.h | 8 ++- kernel/audit.c | 75 ++++++++++++++++++++--- kernel/audit.h | 3 + kernel/audit_fsnotify.c | 5 +- kernel/audit_tree.c | 5 +- kernel/audit_watch.c | 33 +++++----- kernel/auditfilter.c | 52 +++++++++++++++- kernel/auditsc.c | 145 ++++++++++++++++++++++++++++++++++++++++++-- kernel/nsproxy.c | 6 ++ net/core/net_namespace.c | 45 ++++++++++++++ net/netfilter/xt_AUDIT.c | 15 ++++- 17 files changed, 473 insertions(+), 37 deletions(-) -- 1.8.3.1

7 years

6
72
0 / 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Linux-audit June 2018