Linux-audit June 2019

linux-audit@lists.linux-audit.osci.io

10 participants
14 discussions

by Boyce, Kevin P [US] (AS)

Does anyone have any ideas how to prevent the journal from filling up with events that come from audispd? There is a double penalty due to this and it really slows down my system with a lot of rules in place. I have audispd syslog plugin enabled to send remotely as LOG_LOCAL5. Auditd is also writing output to /var/log/audit/audit.log. If you do journalctl -u auditd you also see copies of the syslog events. Is there any way to prevent this behavior? I did find this RedHat page but it doesn't really sound like a good solution, having to modify selinux policy. https://bugzilla.redhat.com/show_bug.cgi?id=1419388 Thanks, Kevin

5 years, 4 months

2
1
0 / 0

Alpha and IA64 processors

by Steve Grubb

Hello, Are there any objections to dropping support for the Alpha and IA64 processors in the master branch of audit user space? I would like to reduce the maintenance burden and if noone is using these, I'll delete them on May 24. Thanks, -Steve

5 years, 4 months

1
1
0 / 0

Auditd Troubleshooting

by Boyce, Kevin P [US] (AS)

Dear List, It would be really great if there were an audit rule hit counter like many firewalls have when IP traffic passes through a filter rule. This would be beneficial for finding rules that might not be working the as intended (to fix user implementation problems). I'm thinking it would be a switch option on auditctl -l (maybe -h for hitcount). This would list each rule that the kernel has, and how many times since auditd started that an event matched the rule. Is this within the realm of feasibility? Does this function exist maybe elsewhere in the audit suite (like aureport)? Kind Regards, Kevin

5 years, 4 months

2
2
0 / 0

[PATCH ghak90 V6] fixup! audit: add containerid filtering

by Richard Guy Briggs

Remove the BUG() call since we will never have an invalid op value as audit_data_to_entry()/audit_to_op() ensure that the op value is a a known good value. Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com> --- kernel/auditfilter.c | 1 - 1 file changed, 1 deletion(-) diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c index 407b5bb3b4c6..385a114a1254 100644 --- a/kernel/auditfilter.c +++ b/kernel/auditfilter.c @@ -1244,7 +1244,6 @@ int audit_comparator64(u64 left, u32 op, u64 right) case Audit_bittest: return ((left & right) == right); default: - BUG(); return 0; } } -- 1.8.3.1

5 years, 5 months

3
3
0 / 0

← Newer
1
2
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Linux-audit June 2019