Re: [PATCH] userspace: audit: ausearch doesn't return entries for AppArmor events that exist in the log
2:03 a.m.
Hi,
There was email about fixing ausearch for AppArmor:
https://www.redhat.com/archives/linux-audit/2014-May/msg00094.html
Is there any progress regarding that issue?
I have tried to search for AVC on Debian Testing (auditd 2.4.5), and
it fails to "grep" me AppArmor related events.
P.S. How do I actually reply to original thread that I did not
received, since I just subscribed? I though I could maybe find raw
message in archive https://www.redhat.com/archives/linux-audit/ but
there aren't (no such message in 2014-May/Jun gz) . Oh how I hate
using mailing lists so much... /rant.
8:39 a.m.
New subject: [PATCH] userspace: audit: ausearch doesn't return entries for AppArmor events that exist in the log
On Friday, April 29, 2016 10:03:02 AM Vincas Dargis wrote:
There was email about fixing ausearch for AppArmor:
https://www.redhat.com/archives/linux-audit/2014-May/msg00094.html
Is there any progress regarding that issue?
You'll have to ask the AppArmor folks. I gave them a whole block of numbers to
use for their own purposes so that we don't have any problems. If they instead
create malformed SE Linux events, then things will never work right unless
they patch them. I don't plan to carry a patch in the main utility because it
completely violates all audit assumptions.
The main rule is that all audit records of the same type have to have the
exact same fields, in the same order, with the same format or no one can
analyze the events. You have to think of each record as a database table. Each
record is a row, each field is a column.
I have tried to search for AVC on Debian Testing (auditd 2.4.5), and
it fails to "grep" me AppArmor related events.
P.S. How do I actually reply to original thread that I did not
received, since I just subscribed? I though I could maybe find raw
message in archive https://www.redhat.com/archives/linux-audit/ but
there aren't (no such message in 2014-May/Jun gz) . Oh how I hate
using mailing lists so much... /rant.
Just start a new one. Why worry?
-Steve
11:07 a.m.
New subject: [PATCH] userspace: audit: ausearch doesn't return entries for AppArmor events that exist in the log
2016.04.29 16:39, Steve Grubb rašė:
You'll have to ask the AppArmor folks. I gave them a whole block
of numbers to
use for their own purposes so that we don't have any problems. If they instead
create malformed SE Linux events, then things will never work right unless
they patch them.
Thank you for explanation, Steve. I'll bring this topic for them instead.
11:30 a.m.
New subject: [PATCH] userspace: audit: ausearch doesn't return entries for AppArmor events that exist in the log
On Friday, April 29, 2016 07:07:06 PM Vincas Dargis wrote:
2016.04.29 16:39, Steve Grubb rašė:
> You'll have to ask the AppArmor folks. I gave them a whole block of
> numbers to use for their own purposes so that we don't have any problems.
> If they instead create malformed SE Linux events, then things will never
> work right unless they patch them.
Thank you for explanation, Steve. I'll bring this topic for them instead.
Just to clarify, its not like I don't want this to work. I do. The intention
of giving app armor its own block was that things its doing might not be a
100% fit for what SE Linux does. This was to give them the freedom to do their
own thing. If they chose not to use the block and instead try to shoe-horn
their events into a pre-existing one, there needs to be some discussion about
how to make things right.
-Steve
4:18 p.m.
New subject: [PATCH] userspace: audit: ausearch doesn't return entries for AppArmor events that exist in the log
On Fri, Apr 29, 2016 at 12:30 PM, Steve Grubb <sgrubb(a)redhat.com> wrote:
On Friday, April 29, 2016 07:07:06 PM Vincas Dargis wrote:
> 2016.04.29 16:39, Steve Grubb rašė:
> > You'll have to ask the AppArmor folks. I gave them a whole block of
> > numbers to use for their own purposes so that we don't have any problems.
> > If they instead create malformed SE Linux events, then things will never
> > work right unless they patch them.
>
> Thank you for explanation, Steve. I'll bring this topic for them instead.
Just to clarify, its not like I don't want this to work. I do. The intention
of giving app armor its own block was that things its doing might not be a
100% fit for what SE Linux does. This was to give them the freedom to do their
own thing. If they chose not to use the block and instead try to shoe-horn
their events into a pre-existing one, there needs to be some discussion about
how to make things right.
-Steve
--
Linux-audit mailing list
Linux-audit(a)redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit
[NOTE: I'm adding the AppArmor maintainer, John Johansen to this thread]
Hi John,
Heads-up, it looks like there might be some issues with AppArmor and auditing...
--
paul moore
security @ redhat
10:41 a.m.
New subject: [PATCH] userspace: audit: ausearch doesn't return entries for AppArmor events that exist in the log
On 16/04/29, Vincas Dargis wrote:
P.S. How do I actually reply to original thread that I did not
received, since I just subscribed? I though I could maybe find raw
message in archive https://www.redhat.com/archives/linux-audit/ but
there aren't (no such message in 2014-May/Jun gz) . Oh how I hate
using mailing lists so much... /rant.
The archives are a bit of a pain to download. I have found that
chromium, wget, curl all get messed up half-text half-compressed files
from this archive server, but firefox is able to download them properly.
The messages are all in the archives.
You are welcome to your rant. I quite like mailing lists and IRC. I
hate most other social media and forums. What do you suggest instead?
- RGB
--
Richard Guy Briggs <rgb(a)redhat.com>
Kernel Security Engineering, Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635
11:58 a.m.
New subject: [PATCH] userspace: audit: ausearch doesn't return entries for AppArmor events that exist in the log
2016.04.29 18:41, Richard Guy Briggs rašė:
You are welcome to your rant. I quite like mailing lists and IRC.
I
hate most other social media and forums. What do you suggest instead?
Hi,
I guess it's plain personal preference, but I just get annoyed once I have to deal
with lists. That's why:
1. No explicit search function. Yes I know (_now_) that you can use your search engine
with site: prefix, but that's too
"hidden" feature, and one have to "know" that from somewhere. I
don't know why Mailman or (whatever that list engine is)
couldn't have at least search box that redirects to some search engine, if they
don't want to incorporate local search
engine by themselves.
2. No (easy?) way to continue thread if not subscribed earlier. Debian bug tracker, that
is based on email, does in fact
has "mbox" download link for specific post. But that's rarity I guess. In
forums you just click "reply" button. In list,
you have to download .gz archive (which apparently failed in my latest Firefox 46 case)
and edit it to make single .mbox
or whatever? ...
Steve suggested just to start new thread. Yeah, but.. that's kinda cheating, and issue
still exists and I guess I am
(too) picky for these kind of usability "papprecuts", hence, the rant :-) .
3. Once subscribed, you may get lot's of lot's of emails, even if you are
interested in only that single topic (or some
topics, maybe started long time ago), so you can just "lose"/forget/skip
relevant reply. Meanwhile, forums have
notification function you cane enable for topics you are "watching".
4. No formatting options. It's sometimes hard to read code or other technical text
embedded inside plain text email.
Meanwhile, using markdown/bbcode/whatever you can make technical keywords, file paths, or
whole code blocks distinct
from plain text. Makes eyes happy.
Forums also have issues, like.. having gazillion of accounts (that simple email activation
in lists makes it much easier
actually). Also, I imagine getting all list traffic by default might be good for
maintainers who want to hear (ok, read)
all relevant issues. In forums, you should click-through all "highlighted"
topics manually? Oh my...
Anyway, this off-topic should be in Mailman list probably :-) . All these are actually
small, "bells-and-wistles",
"pappercut" issues I guess, but that's enough to make me *sigh* when I see I
will have to deal with mailing list instead
of full-fledged bug tracker or at least a forum.
3104
days inactive
3107
days old
linux-audit@lists.linux-audit.osci.io
6 comments
4 participants
participants (4)
-
Paul Moore -
Richard Guy Briggs -
Steve Grubb -
Vincas Dargis