Re: stime(2) auditing on x86_64
On Sunday 28 October 2007 05:51:03 pm Todd, Charles wrote:
> That is because x86_64 does not have that syscall. It uses
> settimeofday for the same functionality. But, it does exist
> in the 32 bit compatibility layer.
Okay, I understand the bi-arch thing except one thing: does that mean
the 32-bit compatability layer is ultimately calling the 64-bit version?
Somewhere deeper inside, they probably share some code. But the audit hooks
are at the entry/exit to the syscall. So, covering one does not cover the
other. As Matt mentioned, you need 2 syscall rules explicitly stating bit
size.
> Not really, I think DISA is telling you the intent and that
> needs to be interpretted/extended to cover bi-arch systems.
DISA's intent and their SRRs have always been two completely separate
entities. Testers only see that I don't have that flag, and less
resourceful security folks won't know how to argue back. Ultimately, we
need to teach DISA to write better tests.
I'll be updating the sample audit rule sets in the next release to reflect
both the subtree audit capability (since that's now merged in 2.6.24) and the
bit sizing. Hopefully this updated rule set will trickle down to the right
places.
-Steve