8:53 a.m.
Hello,
Sometimes audit of "execve" syscall generates events with truncated
"comm" values, for example:
type=SYSCALL msg=audit(1459950426.152:1097081): arch=c000003e syscall=59
success=yes exit=0 a0=35bae3e a1=1bc0cf0 a2=2b09280 a3=58c items=2
ppid=2183 pid=26566 auid=4294967295 uid=1001 gid=1001 euid=1001
suid=1001 fsuid=1001 egid=1001 sgid=1001 fsgid=1001 tty=(none)
ses=4294967295 comm="gnome-calculato" exe="/usr/bin/gnome-calculator"
Why "comm" is "gnome-calculato" and not
"/usr/bin/gnome-calculator" ?
Same for Firefiox:
type=SYSCALL msg=audit(1459950158.667:1092149): arch=c000003e syscall=59
success=yes exit=0 a0=7f913ed1ddf0 a1=7f9144819be0 a2=7f9173f14400
a3=786f666572696600 items=2 ppid=26165 pid=26247 auid=4294967295
uid=1001 gid=1001 euid=1001 suid=1001 fsuid=1001 egid=1001 sgid=1001
fsgid=1001 tty=(none) ses=4294967295 comm="plugin-containe"
exe="/usr/lib/firefox/plugin-container"
comm is "plugin-containe" and not "plugin-container".
Audit version is 2.4.2-1ubuntu1.
-Lev
9:05 a.m.
On Wed, Apr 6, 2016 at 9:53 AM, Lev Stipakov <lstipakov(a)gmail.com> wrote:
Hello,
Sometimes audit of "execve" syscall generates events with truncated
"comm"
values, for example:
type=SYSCALL msg=audit(1459950426.152:1097081): arch=c000003e syscall=59
success=yes exit=0 a0=35bae3e a1=1bc0cf0 a2=2b09280 a3=58c items=2 ppid=2183
pid=26566 auid=4294967295 uid=1001 gid=1001 euid=1001
suid=1001 fsuid=1001 egid=1001 sgid=1001 fsgid=1001 tty=(none)
ses=4294967295 comm="gnome-calculato"
exe="/usr/bin/gnome-calculator"
Why "comm" is "gnome-calculato" and not
"/usr/bin/gnome-calculator" ?
This is due to a limitation in how the kernel records the comm field
and isn't likely to change.
--
paul moore
www.paul-moore.com
9:37 a.m.
On Wednesday, April 06, 2016 10:05:35 AM Paul Moore wrote:
On Wed, Apr 6, 2016 at 9:53 AM, Lev Stipakov
<lstipakov(a)gmail.com> wrote:
> Hello,
>
> Sometimes audit of "execve" syscall generates events with truncated
"comm"
> values, for example:
>
> type=SYSCALL msg=audit(1459950426.152:1097081): arch=c000003e syscall=59
> success=yes exit=0 a0=35bae3e a1=1bc0cf0 a2=2b09280 a3=58c items=2
> ppid=2183 pid=26566 auid=4294967295 uid=1001 gid=1001 euid=1001
> suid=1001 fsuid=1001 egid=1001 sgid=1001 fsgid=1001 tty=(none)
> ses=4294967295 comm="gnome-calculato"
exe="/usr/bin/gnome-calculator"
>
> Why "comm" is "gnome-calculato" and not
"/usr/bin/gnome-calculator" ?
This is due to a limitation in how the kernel records the comm field
and isn't likely to change.
And just to add some history to this, there was a big discussion about this
back when the AUDIT_PROCTITLE record was added to syscall events. (Jan 2014)
Mainline kernel wouldn't allow it to be increased. So, we wound up with the
PROCTITLE record which supplies the missing information and more.
-Steve
10:21 a.m.
On 16/04/06, Paul Moore wrote:
On Wed, Apr 6, 2016 at 9:53 AM, Lev Stipakov
<lstipakov(a)gmail.com> wrote:
> Hello,
>
> Sometimes audit of "execve" syscall generates events with truncated
"comm"
> values, for example:
>
> type=SYSCALL msg=audit(1459950426.152:1097081): arch=c000003e syscall=59
> success=yes exit=0 a0=35bae3e a1=1bc0cf0 a2=2b09280 a3=58c items=2 ppid=2183
> pid=26566 auid=4294967295 uid=1001 gid=1001 euid=1001
> suid=1001 fsuid=1001 egid=1001 sgid=1001 fsgid=1001 tty=(none)
> ses=4294967295 comm="gnome-calculato"
exe="/usr/bin/gnome-calculator"
>
> Why "comm" is "gnome-calculato" and not
"/usr/bin/gnome-calculator" ?
This is due to a limitation in how the kernel records the comm field
and isn't likely to change.
It is set in the kernel, in file include/linux/sched.h,
struct task_struct, member comm, with length TASK_COMM_LEN which is 16.
Changing it would break all kinds of stuff, so as was mentioned,
PROCTITLE is used to get the kind of information you seek.
paul moore
- RGB
--
Richard Guy Briggs <rbriggs(a)redhat.com>
Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545
3182
days inactive
3182
days old
linux-audit@lists.linux-audit.osci.io
3 comments
4 participants
participants (4)
-
Lev Stipakov -
Paul Moore -
Richard Guy Briggs -
Steve Grubb