Re: Early processes (daemons) do not report audit events

On Sep 9, 2015, at 11:50 PM, Kangkook Jee <aixer77(a)gmail.com&gt; wrote: Dear all, We are developing custom user space audit agent to gather system wide system call trace. While experimenting with various programs, we found out that processes (daemons) that started early (along with the system bootstrapping) do not report any audit events at all. These processes typically fall into PID range of less than 2000. Here’s how I reproduced the symptom with sshd daemon. 1. Reboot the system 2. Add and enable audit events # /sbin/auditctl -a exit,always -F arch=b64 -S clone -S close -S creat -S dup -S dup2 -S dup3 -S execve -S exit -S exit_group -S fork -S open -S openat -S unlink -S unlinkat -S vfork -S 288 -S accept -S bind -S connect -S listen -S socket -S socketpair # /sbin/auditctl -e1 -b 102400 3. Connect to the system via ssh Audit messages generated only from child processes and none are seen from the original daemon. 4. Restart sshd # restart ssh 5. Connect again to the system via ssh Now, we see audit messages from both parent and child processes. I did the experiment from Ubuntu 14.04.2 LTS distribution (64-bit, kernel version 3.13.0-58-generic). I first wonder whether this is intended behavior of audit framework or not. If it is intended, I also want to know how can we configure auditd differently to capture system calls from all processes. Thanks a lot for your help in advance! Regards, Kangkook