3:38 p.m.
On the call Monday, I said I'll test on an lspp.12 kernel. I ran our
CAPP audit test suite on an x86_64 installed with FC5-t3, and lspp.12
kernel. Audit version 1.1.5. Below are my results ..
- All syscall test passed with no problems
- object identity (watch) tests (and any other tests that use watches)
all failed due to inability to insert watches, I get the following
Error sending watch insert request (Invalid argument)
add_audit_rule failed - auditctl_comm [auditctl -w /tmp/lafa0qlNM -k
file-basic-key ] returned 255
- Saw some failures in filters tests due the change in the message of
adding/removing audit rules in the CONFIG_CHANGE type records. It used
to be "added/removed an audit rule" and now it is "add/remove rule
to/from list=X"... is there a reason we changed the message?
- Saw some failures in trusted programs due to the missing
msg='SomeString (ex, gpasswd, password, chage ..etc) field from the
audit record in some instances. Our test cases check for that string and
are failing if it's not found... Is there a reason this was removed?
- Loulwa
6:09 p.m.
- Saw some failures in trusted programs due to the missing
msg='SomeString (ex, gpasswd, password, chage ..etc) field from the
audit record in some instances. Our test cases check for that string
and are failing if it's not found... Is there a reason this was
removed?
I only ran our syscall tests before but now I see similar failures in
some of our trusted program tests.
-- ljk
9:12 a.m.
On Wednesday 15 March 2006 16:38, Loulwa Salem wrote:
Our test cases check for that string and
are failing if it's not found... Is there a reason this was removed?
Everything was changed over to a standard logging function so that the format
will be consistent across all packages. Previously, each package had its own
format.
-Steve
12:38 p.m.
Hi Steve,
Maybe you could post something about the standard logging
function and what the records ought to look like these days?
I think having consistent records is a good thing but it would
have been nice to see them here first since the changes have an
impact. Loulwa mentioned a case where the string is missing.
I don't know if its really missing or just not found exactly
as expected. Do you know if any messages were omitted as
part of the conversion?
Thanks,
-- ljk
Steve Grubb wrote:
On Wednesday 15 March 2006 16:38, Loulwa Salem wrote:
>Our test cases check for that string and
>are failing if it's not found... Is there a reason this was removed?
Everything was changed over to a standard logging function so that the format
will be consistent across all packages. Previously, each package had its own
format.
-Steve
--
Linux-audit mailing list
Linux-audit(a)redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit
12:46 p.m.
On Monday 20 March 2006 13:38, Linda Knippers wrote:
Maybe you could post something about the standard logging
function and what the records ought to look like these days?
There is work ongoing for a new parsing library. I think changing over to it
will solve everybody's problems...or at least it will cause standardization
since we'll be able to get similar results.
-Steve
12:50 p.m.
Steve Grubb wrote:
On Monday 20 March 2006 13:38, Linda Knippers wrote:
>Maybe you could post something about the standard logging
>function and what the records ought to look like these days?
There is work ongoing for a new parsing library. I think changing over to it
will solve everybody's problems...or at least it will cause standardization
since we'll be able to get similar results.
I'm still interested in what the records in audit.log look like.
Our test suite already parses those records and its pretty forgiving
when it comes to format. I'm more interested in information that's
being added or removed as that's what seems to have happened in
the trusted programs.
-- ljk
12:58 p.m.
On Monday 20 March 2006 13:50, Linda Knippers wrote:
I'm still interested in what the records in audit.log look like.
I don't have any table with that information in it. You'd have to just look at
them. We've added subject & object labels to many things. Also added tty to
syscall records.
I'm more interested in information that's being added or
removed as that's
what seems to have happened in the trusted programs.
They all use a standard logging function now to ensure consistency. But they
will be changing slightly when we merge the patch from Tim to add subject
label to user space originating event.
Best bet is just to eyeball the logs.
-Steve
1:03 p.m.
They all use a standard logging function now to ensure consistency.
But they
will be changing slightly when we merge the patch from Tim to add subject
label to user space originating event.
Best bet is just to eyeball the logs.
Maybe you could post something to the list when the programs are
changed? Perhaps with a sample of the new records? Others
have done that and its been helpful.
-- ljk
1:10 p.m.
On Monday 20 March 2006 14:03, Linda Knippers wrote:
Maybe you could post something to the list when the programs are
changed? Perhaps with a sample of the new records? Others
have done that and its been helpful.
Unless anyone says otherwise, they are all already changed. FC5 is shipping
with them in the new format. I don't have time to go dig up example records
at this point. All this work happened a long time ago. Oct/Nov.
-Steve
1:15 p.m.
Steve Grubb wrote:
On Monday 20 March 2006 14:03, Linda Knippers wrote:
>Maybe you could post something to the list when the programs are
>changed? Perhaps with a sample of the new records? Others
>have done that and its been helpful.
Unless anyone says otherwise, they are all already changed. FC5 is shipping
with them in the new format. I don't have time to go dig up example records
at this point. All this work happened a long time ago. Oct/Nov.
I guess I misunderstood. I thought you said there were more changes
coming when Tim's patch is merged in. Even if you posted something
that said the standard function used to issue something like this
and now it issues something like that, it would be helpful.
-- ljk
1:17 p.m.
linux-audit-bounces(a)redhat.com wrote on 03/20/2006 01:10:14 PM:
On Monday 20 March 2006 14:03, Linda Knippers wrote:
> Maybe you could post something to the list when the programs are
> changed? Perhaps with a sample of the new records? Others
> have done that and its been helpful.
Unless anyone says otherwise, they are all already changed. FC5 is
shipping
with them in the new format. I don't have time to go dig up
example
records
at this point. All this work happened a long time ago. Oct/Nov.
I think the point wasn't for you to obtain a list of what has been done
and post that, but rather should anything else change in future
development, that those changes be posted with an example of what has
changed, so people have a heads up. I would also find this to be useful
and interesting.
Mike
1:17 p.m.
Michael C Thompson wrote:
I think the point wasn't for you to obtain a list of what has
been done
and post that, but rather should anything else change in future
development, that those changes be posted with an example of what has
changed, so people have a heads up.
Yes, that's what I meant. Thanks.
-- ljk
2:51 p.m.
Linda Knippers wrote:
Hi Steve,
... Loulwa mentioned a case where the string is missing.
I don't know if its really missing or just not found exactly
as expected. Do you know if any messages were omitted as
part of the conversion?
From what I am seeing, I was talking about the msg= field which I am
seeing is missing values ...
here is an example of what we used to see before, and what I am seeing
now with the lspp.12 kernel ...
Notice that in the first record there is a <msg=groudel> field, while in
the second record, it is <msg='op=deleting group>.
type=USER_CHAUTHTOK msg=audit(1142347489.501:5273): user pid=12084 uid=0
auid=0 msg='groupdel: op=deleting group acct=laf_z
exe="/usr/sbin/groupdel" (hostname=?, addr=?, terminal=pts/1 res=success)'
type=USER_CHAUTHTOK msg=audit(1142347489.501:5273): user pid=12084 uid=0
auid=0 msg='op=deleting group acct=laf_z exe="/usr/sbin/groupdel"
(hostname=?, addr=?, terminal=pts/1 res=success)'
- Loulwa
6966
days inactive
6971
days old
linux-audit@lists.linux-audit.osci.io
12 comments
4 participants
participants (4)
-
Linda Knippers -
Loulwa Salem -
Michael C Thompson -
Steve Grubb