10:21 a.m.
This is a really strange problem .. seems like I have a knack to finding those.
I am running lspp.18 kernel (SELinux in permissive mode), audit-1.2.1 on an
x86_64 system.
Here is what is happening .. someone else please try this and let me know if you
see the same problem...
# auditctl -w /tmp/file1 >> works fine
# auditctl -w /tmp/file6
Error sending add rule request (File exists)
# auditctl -w /tmp/afile
Error sending add rule request (File exists)
# auditctl -w /tmp/newfile >> works fine
# auditctl -w /tmp/thefile
Error sending add rule request (File exists)
Here is what I noticed from this pattern ... as long as the length of the file
name I am adding watch on is the same, it says the watch already exists... So I
tried something else to see if only the file name matters or the whole path
length ...
# mkdir /foo
# auditctl -w /foo/file3 >> notice .. same length as /tmp/file1
Error sending add rule request (File exists)
# auditctl -w /foo/foofile >> notice .. same length as /tmp/newfile
Error sending add rule request (File exists)
# auditctl -w /foo/anotherfile >> works fine
So you see ... even using a different directory still says the watch exists.
If this is happening with others .. this definitely seems like a bug to me.
Thanks,
-Loulwa
10:51 a.m.
That's really strange. I'm running the .16 kernel and the audit-1.2
audit tools on an x86 and I'm not seeing the problem. I'll upgrade and
see what happens.
-- ljk
Loulwa Salem wrote:
This is a really strange problem .. seems like I have a knack to
finding
those.
I am running lspp.18 kernel (SELinux in permissive mode), audit-1.2.1 on
an x86_64 system.
Here is what is happening .. someone else please try this and let me
know if you see the same problem...
# auditctl -w /tmp/file1 >> works fine
# auditctl -w /tmp/file6
Error sending add rule request (File exists)
# auditctl -w /tmp/afile
Error sending add rule request (File exists)
# auditctl -w /tmp/newfile >> works fine
# auditctl -w /tmp/thefile
Error sending add rule request (File exists)
Here is what I noticed from this pattern ... as long as the length of
the file name I am adding watch on is the same, it says the watch
already exists... So I tried something else to see if only the file name
matters or the whole path length ...
# mkdir /foo
# auditctl -w /foo/file3 >> notice .. same length as /tmp/file1
Error sending add rule request (File exists)
# auditctl -w /foo/foofile >> notice .. same length as /tmp/newfile
Error sending add rule request (File exists)
# auditctl -w /foo/anotherfile >> works fine
So you see ... even using a different directory still says the watch
exists.
If this is happening with others .. this definitely seems like a bug to me.
Thanks,
-Loulwa
--
Linux-audit mailing list
Linux-audit(a)redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit
10:59 a.m.
On Monday 24 April 2006 11:51, Linda Knippers wrote:
That's really strange. I'm running the .16 kernel and the
audit-1.2
audit tools on an x86 and I'm not seeing the problem. I'll upgrade and
see what happens.
I see the same probelm that Loulwa is reporting on .18 kernel.
-Steve
1:07 p.m.
On Mon, Apr 24, 2006 at 11:59:33AM -0400, Steve Grubb wrote:
On Monday 24 April 2006 11:51, Linda Knippers wrote:
> That's really strange. ?I'm running the .16 kernel and the audit-1.2
> audit tools on an x86 and I'm not seeing the problem. ?I'll upgrade and
> see what happens.
I see the same probelm that Loulwa is reporting on .18 kernel.
Hmm. Looks like the filesystem audit patches didn't make it into the
.18 kernel. The kernel doesn't reject field types it doesn't know
about, so it's adding the rule with field type 105 and value
strlen(path).
diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c
index d3a8539..63aa039 100644
--- a/kernel/auditfilter.c
+++ b/kernel/auditfilter.c
[..]
@@ -188,8 +211,9 @@ static struct audit_entry *audit_data_to
int err = 0;
struct audit_entry *entry;
void *bufp;
- /* size_t remain = datasz - sizeof(struct audit_rule_data); */
+ size_t remain = datasz - sizeof(struct audit_rule_data);
int i;
+ char *str;
entry = audit_to_entry_common((struct audit_rule *)data);
if (IS_ERR(entry))
@@ -207,10 +231,35 @@ static struct audit_entry *audit_data_to
f->op = data->fieldflags[i] & AUDIT_OPERATORS;
f->type = data->fields[i];
+ f->val = data->values[i];
+ f->se_str = NULL;
+ f->se_rule = NULL;
switch(f->type) {
- /* call type-specific conversion routines here */
- default:
- f->val = data->values[i];
+ case AUDIT_SE_USER:
+ case AUDIT_SE_ROLE:
+ case AUDIT_SE_TYPE:
+ case AUDIT_SE_SEN:
+ case AUDIT_SE_CLR:
+ str = audit_unpack_string(&bufp, &remain, f->val);
+ if (IS_ERR(str))
+ goto exit_free;
+ entry->rule.buflen += f->val;
+
+ err = selinux_audit_rule_init(f->type, f->op, str,
+ &f->se_rule);
+ /* Keep currently invalid fields around in case they
+ * become valid after a policy reload. */
+ if (err == -EINVAL) {
+ printk(KERN_WARNING "audit rule for selinux "
+ "\'%s\' is invalid\n", str);
+ err = 0;
+ }
+ if (err) {
+ kfree(str);
+ goto exit_free;
+ } else
+ f->se_str = str;
+ break;
}
}
6763
days inactive
6763
days old
linux-audit@lists.linux-audit.osci.io
4 comments
4 participants
participants (4)
-
Amy Griffis -
Linda Knippers -
Loulwa Salem -
Steve Grubb