On Mon, 2005-04-11 at 13:40 -0400, Steve Grubb wrote: Is the audit dæmon flushing the queue completely before it shuts down, or just exiting immediately? The message should definitely be in the queue before the signal is delivered. -- dwmw2

On Monday 11 April 2005 15:13, David Woodhouse wrote: I did this: strace /sbin/auditd -f and got this: recvfrom(3, "$\0\0\0\2\0\0\0\1\0\0\0\301\17\0\0\0\0\0\0000\0\0\0\351"..., 1216, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 36 write(2, "Init complete, audit pid set to:"..., 37Init complete, audit pid set to: 4033) = 37 write(2, "\n", 1 ) = 1 select(4, [3], NULL, NULL, {30, 0}) = 1 (in [3], left {30, 0}) recvfrom(3, ";\0\0\0\320\7\0\0\0\0\0\0\0\0\0\0audit(1113248675"..., 1216, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 75 futex(0x8050ea0, FUTEX_WAKE, 1) = 1 futex(0x8050e9c, FUTEX_WAKE, 1) = 1 futex(0x8050e84, FUTEX_WAKE, 1type=KERNEL msg=audit(1113248675.648:0): audit_enabled=1 old=1 by auid 4325 ) = 1 select(4, [3], NULL, NULL, {30, 0}) = 1 (in [3], left {30, 0}) recvfrom(3, "$\0\0\0\2\0\0\0\2\0\0\0\301\17\0\0\0\0\0\0000\0\0\0\351"..., 1216, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 36 select(4, [3], NULL, NULL, {30, 0}) = ? ERESTARTNOHAND (To be restarted) --- SIGCONT (Continued) @ 0 (0) --- select(4, [3], NULL, NULL, {16, 36000}) = ? ERESTARTNOHAND (To be restarted) --- SIGCONT (Continued) @ 0 (0) --- In another terminal, I did this: kill -s SIGCONT 4033 When sigterm is sent, I get this: select(4, [3], NULL, NULL, {30, 0}) = ? ERESTARTNOHAND (To be restarted) --- SIGTERM (Terminated) @ 0 (0) --- write(2, "Signal 15\n", 10Signal 15 ) = 10 sigreturn() = ? (mask now []) getuid32() = 0 time(NULL) = 1113248847 futex(0x8050ea0, FUTEX_WAKE, 1) = 1 futex(0x8050e9c, FUTEX_WAKE, 1) = 1 futex(0x8050e84, FUTEX_WAKE, 1type=DAEMON msg=auditd(1113248847) auditd normal halt, pid=4033, uid=0 ) = 1 sched_yield() = 0 rt_sigaction(SIGALRM, {0x8049627, [], SA_RESTORER, 0xc957e8}, NULL, 8) = 0 alarm(5) = 0 write(2, "The audit daemon is exiting.", 28The audit daemon is exiting.) = 28 write(2, "\n", 1 ) = 1 sendto(3, "0\0\0\0\351\3\5\0\3\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0\0\0"..., 48, 0, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 48 nanosleep({0, 100000000}, NULL) = 0 recvfrom(3, "$\0\0\0\2\0\0\0\3\0\0\0\301\17\0\0\0\0\0\0000\0\0\0\351"..., 1216, MSG_PEEK|MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 36 recvfrom(3, "$\0\0\0\2\0\0\0\3\0\0\0\301\17\0\0\0\0\0\0000\0\0\0\351"..., 1216, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 36 nanosleep({0, 100000000}, NULL) = 0 recvfrom(3, 0xbfe4d4c0, 1216, 64, 0xbfe4d470, 0xbfe4d46c) = -1 EAGAIN (Resource temporarily unavailable) close(3) = 0 unlink("/var/run/auditd.pid") = 0 munmap(0xb7f32000, 4096) = 0 exit_group(0) = ? Again, no sign of a signal to the audit daemon event. -Steve

On Monday 11 April 2005 19:27, Stephen Smalley wrote: <snip> Yeah, I finished work up on the user space/kernel space transport feature (separated the kernel/user audit_watch structure, added a transport structure per Stephen's suggestions, etc) and completed a basic watch listing feature, which will return to user space a list of all watches. If at the time of the listing, the watch's parent could be reached, its returned as a "valid" path, otherwise it's returned as an "invalid" path. The last bit of information that needs to be added and finalized before I submit is a new field on the watch for "device", so when a list is sent back to user space you can tell the difference between the watch "/tmp/foo" and "/tmp/foo" ;-) Granted, this is probably a little over board as far as a CAPP certification is concerned, but I figure it's generally useful; can't hurt. I'm also a little concerned about how the administrator is going to be able to _effectively_, _realistically_, and _intuitively_ interpret what they're seeing in the audit log with regards to file system auditing. This is mostly due to the possibility of a single syscall generating multiple records. Even I have to double check the hook placement to make complete sense of all the records being generated. When we document expected results they should be perfectly explainable, wouldn't you agree? So, perhaps some kind of flagging that's human readable in the audit record (ie: CREATE_*, UNLINK, RENAME_TO, RENAME_FROM, PERMISSION, etc) would prove useful. Perhaps something we can talk about tomorrow. -tim

David Woodhouse <dwmw2(a)infradead.org&gt; wrote: Mainly because it was conflicting with some work Andi was trying to get right in x86_64. I can probably bring it back next time.

On Mon, 2005-04-11 at 15:17 +0000, Timothy R. Chavez wrote: bk://linux-audit.bkbits.net/audit-2.6-mm or the RPM. -- dwmw2

On Tuesday 12 April 2005 16:58, Valdis.Kletnieks(a)vt.edu wrote: ftp://ftp.uk.linux.org/pub/people/dwmw2/audit/ I'll also put this on my people.redhat.com page. -Steve