Re: Writting to audit with an application

On Saturday 17 March 2007 17:34:57 geckiv wrote: > Thanks for the reply. I must have something wrong with my system as I >can't get it to work even running it as root. I get an error of: > >FAILURE: errno = 22 >Error writing audit file: Invalid argument >Error writing audit: Illegal seek > > This does sound wrong. Maybe strace would shed some light on how its going wrong? What kernel are you using? >Also how do I set auditd to allow other process(s) running not as root >to write to the netlink/kernel ( i.e. set CAP_AUDIT_WRITE)? > > You can't. The audit system is designed to be high integrity meaning only trusted apps or processes that run as root or started as root but dropped privileges keeping CAP_AUDIT_WRITE. The audit event is written to the kernel, not auditd (meaning the kernel must be compiled with syscall audit support at a minimum). The kernel may decide to give the event to auditd. >I could not find any info on this. Also where do I find these trusted app >examples? > > dbus, nscd, passwd, shadow-utils, pam, ... >Is this something I down loa the src of Linux and look for? > > No, dbus is an example of a program that keeps CAP_AUDIT_WRITE after starting as root but changes uids. passwd is setuid root. pam runs as part of applications that stay root. -Steve