March 2010 - Linux-audit - Linux-Audit List Archives

by LC Bruzenak

I know I can go look at the code, however I figured I'd ask here first about the limits on the user message in both audit_log_user_message and ausearch. With audit_log_user_message the maximum length allowed appears to be around MAX_AUDIT_MESSAGE_LENGTH-100. I think it may depend on the executable name length (and other stuff auto-pushed into the string) which is why I say "around". Even when I get a successful return value (from audit_log_user_message), I don't get my string back out in "ausearch" unless it is WAY smaller - ~1K or less I think. Any ideas/thoughts? This is the latest (1.7.11-2) audit package. Thx, LCB. -- LC (Lenny) Bruzenak lenny(a)magitekltd.com

12 years, 7 months

5
17
0 / 0

AUDIT_SIGNAL_INFO

by Matthew Booth

Under what circumstances will the RHEL 4 kernel generate a message of type AUDIT_SIGNAL_INFO? My understanding is that it should be sent when a process sends a signal to the audit daemon, however I have not observed that. Any ideas? Thanks, Matt -- Matthew Booth, RHCA, RHCSS Red Hat, Global Professional Services M: +44 (0)7977 267231 GPG ID: D33C3490 GPG FPR: 3733 612D 2D05 5458 8A8A 1600 3441 EA19 D33C 3490

13 years, 10 months

3
4
0 / 0

Near Term Audit Road Map

by Steve Grubb

Hi, With the proposals sent to the list, I wanted to talk about how this might play out code-wise. With regard to the current code base, I am working on a 1.8 release. This would represent finishing the remote logging app and nothing more. The 1.8 series would become just an update series just like the 1.0.x series did. In parallel with finishing remote logging, I would release a 2.0 version. Patches applied to 1.8 would also be applied to 2.0. A 2.1 release would signify the completion of remote logging that branch. I would recommend this branch for all distributions pulling new code in. The 2.0 branch will also have a couple more changes. I want to split up the audit source code a little bit. I want to drop the system-config-audit code and let it become standalone package updated and distributed separately. I also want to drop all audispd-plugins in the 2.0 branch and have them released separately. They cause unnecessary build dependencies for the audit package. During the work for a 2.2 release, I would also like to pull the audispd program inside auditd. In the past, I tried to keep auditd lean and single purpose, but with adding remote logging and kerberos support, we already have something that is hard to analyze. So, to improve performance and decrease system load, the audit daemon will also do event dispatching. Would this proposal impact anyone in a Bad Way? Thanks, -Steve

13 years, 10 months

4
11
0 / 0

missing user authentication events.

by Robert Harris

14 years, 4 months

3
5
0 / 0

ausearch

by Pittigher, Raymond - CS

I see that the -w or --word switch was added to the ausearch but how it it used? The man pages claim: String based matches must match the whole word. But I have been trying ausearch -w failed and variation of that but only get the message ausearch -if audit.log.3 -w failed failed is an unsupported option This e-mail and any files transmitted with it may be proprietary and are intended solely for the use of the individual or entity to whom they are addressed. If you have received this e-mail in error please notify the sender. Please note that any views or opinions presented in this e-mail are solely those of the author and do not necessarily represent those of ITT Corporation. The recipient should check this e-mail and any attachments for the presence of viruses. ITT accepts no liability for any damage caused by any virus transmitted by this e-mail.

15 years, 5 months

3
2
0 / 0

Events lost with dispatcher

by Vishwanath Venkatesan

Hi, I having troubles receiving events with the dispatcher in ubuntu-9.04. I am just trying to use the rule -a entry, always -S execve -S exit_group I receive all the events in the audit.log, but not in the dispatcher. I am using the dispatcher code in the auditd website. I also using two threads where in one thread collects all the data and the other thread does the parsing. So there is no blocking and the queue is an unbounded concurrent queue. I don't think there can't anything else done at the receiving end. If anyone has faced something similar or have suggestions, please let me know Thanks Vish

16 years

3
6
0 / 0

Re: [PATCH] mapping of reactions

by Miloslav Trmac

Hello, the code looks reasonable, some minor comments are below. I'll let Steve and others comment on the high-level design (just to point out a question, is it OK that auditctl will depend on sqlite?). Mirek ----- "Juraj Hlista" <juro.hlista(a)gmail.com> wrote: > diff --git a/lib/libaudit.c b/lib/libaudit.c > @@ -965,6 +983,14 @@ int audit_rule_fieldpair_data(struct > audit_rule_data **rulep, const char *pair, > strncpy(&rule->buf[offset], v, vlen); > > break; > + case AUDIT_REACTION: > + /* string identifiers were converted to numbers */ > + if (isdigit((char)*(v))) Nitpick: the isdigit argument should be cast to (unsigned char). > diff --git a/lib/reactarray.c b/lib/reactarray.c <snip> > +int react_array_init(struct react_array *a, unsigned int size) <snip> > + a->str = (char **)malloc(size * sizeof(char *)); The return value of malloc() is not usually manually cast in C. > + if (!a->str) > + return 1; > + > + for (i = 0; i < size; i++) > + a->str[i] = NULL; You can just use calloc() to initialize a->str. <snip> > +void react_array_free(struct react_array *a) <snip> > + for (i = 0; i < a->count; i++) { > + if (a->str[i]) > + free(a->str[i]); free(NULL) is OK, so the if ( ) is not necessary. > +int react_array_insert(struct react_array *a, const char *s) > +{ <snip> > + a->str[a->count] = (char *)malloc((strlen(s) + 1) * sizeof(char)); > + if (!a->str[a->count]) > + return 1; > + > + strcpy(a->str[a->count], s); Using strdup() would be simpler. > diff --git a/src/auditctl-reactsql.c b/src/auditctl-reactsql.c <snip> > +enum { > + SQL_CHECK_DB = 0, Just use string constants in the code directly, this indirection is difficult to follow. <snip> > +void sql_print_error(sqlite3 *c, int err) <snip> > + fprintf(stderr, "SQLite error: %s\n", sql_errmsg[-err - 2]); The "-2" is a bit difficult to follow... I'd just sacrifice the two additional empty entries in sql_errmsg. <snip> > +int sql_number_to_reaction(sqlite3 *c, const int num, char **str) <snip> > + *str = malloc((strlen(reaction) + 1) * sizeof(char)); > + if (*str == NULL) { > + sqlite3_finalize(find_str); > + return -SQL_NO_MEMORY; > + } > + strcpy(*str, reaction); Use strdup (). <snip> > +/* > + * Add a reaction to the database - if 'num' is greater than SQL_OFFSET, > + * a reaction identifier (string) is already in the database and only > + * 'used' is incremented. If there is not such a reaction string, a new > + * one is inserted into the database and 'used' is set to 1. > + */ Using a separate variable for "new/existing" would be much cleaner than the magic SQL_OFFSET. Especially see how this implementation detail leaks into auditctl.c. <snip> > +int sql_get_next_number(sqlite3 *c, const char *str) Here as well. > diff --git a/src/auditctl.c b/src/auditctl.c > @@ -917,6 +972,97 @@ static int setopt(int count, int lineno, char <snip> > + if (num > SQL_OFFSET) > + asprintf(&cmd, "react=%u", num - SQL_OFFSET); > + else > + asprintf(&cmd, "react=%u", num); > + if (cmd) { (...) > + } else { > + fprintf(stderr, > + "Out of memory adding reaction\n"); > + sql_close_database(conn); > + return -4; > + } If you reverse the if (cmd) here, the else {} branch becomes the default control flow, resulting in a bit simpler code. > @@ -1022,6 +1168,7 @@ static int fileopt(const char *file) > > /* Parse it */ > if (reset_vars()) { > + free_vars(); I didn't look in detail, this does not match my understanding of "reset_vars()"; reset_vars() is supposed to reinitialize everything for a next command, not free everything. (The free(rule_new) call you moved from reset_vars() to free_vars() was at the beginning of reset_vars(), not at the end.) > @@ -1382,6 +1569,25 @@ static int audit_print_reply(struct audit_reply <snip> > + rc = sql_number_to_reaction(conn, > + rep->ruledata->values[i], > + &str_react); > + if (rc < 0) { I think it's prefereble to print the number if the lookup fails, so that the admin can see at least something from the rule.

16 years

4
5
0 / 0

Re: [PATCH] audit: Reactive rules

by Miloslav Trmac

Hello, ----- "Juraj Hlista" <juro.hlista(a)gmail.com> wrote: > diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c > @@ -415,7 +424,8 @@ static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data, > - int i; > + int i, j = 0; > + int k; > @@ -425,7 +435,7 @@ static struct audit_entry > *audit_data_to_entry(struct audit_rule_data *data, > for (i = 0; i < data->field_count; i++) { > - struct audit_field *f = &entry->rule.fields[i]; > + struct audit_field *f = &entry->rule.fields[i - j]; It would be more clear to have a "source index" (used for "data"), and a "destination index" (used for entry->rule.fields); "j" is currently a difference between the two.

16 years

1
0
0 / 0

aureport header question

by LC Bruzenak

Steve (et. al.): I still see the aureport error (below). Has this been addressed in any patches in the V 2 audit release? Good example: [issm1@audit ~]$ sudo aureport -ts yesterday -i --summary Summary Report ====================== Range of time in logs: 03/25/2010 00:01:02.160 - 03/25/2010 15:26:29.341 Selected time for report: 03/24/2010 00:00:00 - 03/25/2010 15:26:29.341 [issm1@audit ~]$ date Thu Mar 25 16:10:11 UTC 2010 Bad example (note "Range of time in logs" line): [issm1@audit ~]$ sudo aureport -ts yesterday -te 03/25/2010 00:00:00 -i --summary Summary Report ====================== Range of time in logs: 01/01/1970 00:00:00.000 - 01/01/1970 00:00:00.000 Selected time for report: 03/24/2010 00:00:00 - 03/25/2010 00:00:00 Thx, LCB. -- LC (Lenny) Bruzenak

16 years

2
3
0 / 0

[PATCH] audit: Reactive rules

by Juraj Hlista

From: Juraj Hlista <juro.hlista(a)gmail.com> Add support for reactive rules. An audit rule can contain more than one reaction. The reactions are identified by numbers in the kernel and by strings in the user space. Signed-off-by: Juraj Hlista <juro.hlista(a)gmail.com> --- include/linux/audit.h | 9 ++++++++ kernel/audit.c | 8 +++++++ kernel/audit_tree.c | 1 + kernel/audit_watch.c | 1 + kernel/auditfilter.c | 52 ++++++++++++++++++++++++++++++++++++++++++------ kernel/auditsc.c | 23 +++++++++++++++++++++ 6 files changed, 87 insertions(+), 7 deletions(-) diff --git a/include/linux/audit.h b/include/linux/audit.h index f391d45..0325516 100644 --- a/include/linux/audit.h +++ b/include/linux/audit.h @@ -102,6 +102,7 @@ #define AUDIT_EOE 1320 /* End of multi-record event */ #define AUDIT_BPRM_FCAPS 1321 /* Information about fcaps increasing perms */ #define AUDIT_CAPSET 1322 /* Record showing argument to sys_capset */ +#define AUDIT_REACT_RULE 1323 /* Reactive rule */ #define AUDIT_AVC 1400 /* SE Linux avc denial or grant */ #define AUDIT_SELINUX_ERR 1401 /* Internal SE Linux Errors */ @@ -156,6 +157,7 @@ * AUDIT_LIST commands must be implemented. */ #define AUDIT_MAX_FIELDS 64 #define AUDIT_MAX_KEY_LEN 256 +#define AUDIT_MAX_REACTS 8 #define AUDIT_BITMASK_SIZE 64 #define AUDIT_WORD(nr) ((__u32)((nr)/32)) #define AUDIT_BIT(nr) (1 << ((nr) - AUDIT_WORD(nr)*32)) @@ -227,6 +229,8 @@ #define AUDIT_FILTERKEY 210 +#define AUDIT_REACTION 220 + #define AUDIT_NEGATE 0x80000000 /* These are the supported operators. @@ -384,6 +388,8 @@ struct audit_krule { u32 action; u32 mask[AUDIT_BITMASK_SIZE]; u32 buflen; /* for data alloc on list rules */ + u32 react_count; + u32 react[AUDIT_MAX_REACTS]; u32 field_count; char *filterkey; /* ties events to rules */ struct audit_field *fields; @@ -600,6 +606,8 @@ extern void audit_log_d_path(struct audit_buffer *ab, struct path *path); extern void audit_log_key(struct audit_buffer *ab, char *key); +extern void audit_log_react(struct audit_buffer *ab, + u32 count, u32 *react); extern void audit_log_lost(const char *message); extern int audit_update_lsm_rules(void); @@ -623,6 +631,7 @@ extern int audit_enabled; #define audit_log_untrustedstring(a,s) do { ; } while (0) #define audit_log_d_path(b, p, d) do { ; } while (0) #define audit_log_key(b, k) do { ; } while (0) +#define audit_log_react(b, c, r) do { ; } while (0) #define audit_enabled 0 #endif #endif diff --git a/kernel/audit.c b/kernel/audit.c index 05a32f0..6f4fd3b 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -1450,6 +1450,14 @@ void audit_log_key(struct audit_buffer *ab, char *key) audit_log_format(ab, "(null)"); } +void audit_log_react(struct audit_buffer *ab, u32 count, u32 *react) +{ + unsigned int i; + for (i = 0; i < count; i++) + audit_log_format(ab, " react=%u", react[i]); + +} + /** * audit_log_end - end one audit record * @ab: the audit_buffer diff --git a/kernel/audit_tree.c b/kernel/audit_tree.c index 28e5b20..b63faa5 100644 --- a/kernel/audit_tree.c +++ b/kernel/audit_tree.c @@ -468,6 +468,7 @@ static void kill_rules(struct audit_tree *tree) audit_log_format(ab, " dir="); audit_log_untrustedstring(ab, rule->tree->pathname); audit_log_key(ab, rule->filterkey); + audit_log_react(ab, rule->react_count, rule->react); audit_log_format(ab, " list=%d res=1", rule->listnr); audit_log_end(ab); rule->tree = NULL; diff --git a/kernel/audit_watch.c b/kernel/audit_watch.c index 7499397..565fbad 100644 --- a/kernel/audit_watch.c +++ b/kernel/audit_watch.c @@ -249,6 +249,7 @@ static void audit_watch_log_rule_change(struct audit_krule *r, struct audit_watc audit_log_format(ab, " path="); audit_log_untrustedstring(ab, w->path); audit_log_key(ab, r->filterkey); + audit_log_react(ab, r->react_count, r->react); audit_log_format(ab, " list=%d res=1", r->listnr); audit_log_end(ab); } diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c index eb76754..f0eb220 100644 --- a/kernel/auditfilter.c +++ b/kernel/auditfilter.c @@ -229,6 +229,7 @@ static inline struct audit_entry *audit_to_entry_common(struct audit_rule *rule) unsigned listnr; struct audit_entry *entry; int i, err; + int r_count = 0; err = -EINVAL; listnr = rule->flags & ~AUDIT_FILTER_PREPEND; @@ -253,15 +254,23 @@ static inline struct audit_entry *audit_to_entry_common(struct audit_rule *rule) if (rule->field_count > AUDIT_MAX_FIELDS) goto exit_err; + for (i = 0; i < rule->field_count; i++) { + if (rule->fields[i] == AUDIT_REACTION) + ++r_count; + if (unlikely(r_count > AUDIT_MAX_REACTS)) + goto exit_err; + } + err = -ENOMEM; - entry = audit_init_entry(rule->field_count); + entry = audit_init_entry(rule->field_count - r_count); if (!entry) goto exit_err; entry->rule.flags = rule->flags & AUDIT_FILTER_PREPEND; entry->rule.listnr = listnr; entry->rule.action = rule->action; - entry->rule.field_count = rule->field_count; + entry->rule.field_count = rule->field_count - r_count; + entry->rule.react_count = r_count; for (i = 0; i < AUDIT_BITMASK_SIZE; i++) entry->rule.mask[i] = rule->mask[i]; @@ -415,7 +424,8 @@ static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data, struct audit_entry *entry; void *bufp; size_t remain = datasz - sizeof(struct audit_rule_data); - int i; + int i, j = 0; + int k; char *str; entry = audit_to_entry_common((struct audit_rule *)data); @@ -425,7 +435,7 @@ static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data, bufp = data->buf; entry->rule.vers_ops = 2; for (i = 0; i < data->field_count; i++) { - struct audit_field *f = &entry->rule.fields[i]; + struct audit_field *f = &entry->rule.fields[i - j]; err = -EINVAL; @@ -433,6 +443,18 @@ static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data, if (f->op == Audit_bad) goto exit_free; + if (data->fields[i] == AUDIT_REACTION) { + for (k = 0; k < j; k++) { + /* reactions must differ */ + if (entry->rule.react[k] == data->values[i]) + goto exit_free; + } + entry->rule.react[j] = data->values[i]; + ++j; + entry->rule.react_count = j; + continue; + } + f->type = data->fields[i]; f->val = data->values[i]; f->lsm_str = NULL; @@ -601,7 +623,7 @@ static struct audit_rule_data *audit_krule_to_data(struct audit_krule *krule) { struct audit_rule_data *data; void *bufp; - int i; + int i, j; data = kmalloc(sizeof(*data) + krule->buflen, GFP_KERNEL); if (unlikely(!data)) @@ -610,9 +632,9 @@ static struct audit_rule_data *audit_krule_to_data(struct audit_krule *krule) data->flags = krule->flags | krule->listnr; data->action = krule->action; - data->field_count = krule->field_count; + data->field_count = krule->field_count + krule->react_count; bufp = data->buf; - for (i = 0; i < data->field_count; i++) { + for (i = 0; i < krule->field_count; i++) { struct audit_field *f = &krule->fields[i]; data->fields[i] = f->type; @@ -649,6 +671,13 @@ static struct audit_rule_data *audit_krule_to_data(struct audit_krule *krule) data->values[i] = f->val; } } + j = i; + for (i = 0; i < krule->react_count; i++, j++) { + data->fields[j] = AUDIT_REACTION; + data->fieldflags[j] = AUDIT_EQUAL; + data->values[j] = krule->react[i]; + } + for (i = 0; i < AUDIT_BITMASK_SIZE; i++) data->mask[i] = krule->mask[i]; return data; @@ -663,6 +692,7 @@ static int audit_compare_rule(struct audit_krule *a, struct audit_krule *b) if (a->flags != b->flags || a->listnr != b->listnr || a->action != b->action || + a->react_count != b->react_count || a->field_count != b->field_count) return 1; @@ -705,6 +735,10 @@ static int audit_compare_rule(struct audit_krule *a, struct audit_krule *b) return 1; } } + for (i = 0; i < a->react_count; i++) { + if (a->react[i] != b->react[i]) + return 1; + } for (i = 0; i < AUDIT_BITMASK_SIZE; i++) if (a->mask[i] != b->mask[i]) @@ -769,6 +803,9 @@ struct audit_entry *audit_dupe_rule(struct audit_krule *old) new->prio = old->prio; new->buflen = old->buflen; new->inode_f = old->inode_f; + new->react_count = old->react_count; + for (i = 0; i < new->react_count; i++) + new->react[i] = old->react[i]; new->field_count = old->field_count; /* @@ -1075,6 +1112,7 @@ static void audit_log_rule_change(uid_t loginuid, u32 sessionid, u32 sid, audit_log_format(ab, " op="); audit_log_string(ab, action); audit_log_key(ab, rule->filterkey); + audit_log_react(ab, rule->react_count, rule->react); audit_log_format(ab, " list=%d res=%d", rule->listnr, res); audit_log_end(ab); } diff --git a/kernel/auditsc.c b/kernel/auditsc.c index bc2b57a..57ad669 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -176,6 +176,8 @@ struct audit_context { int return_valid; /* return code is valid */ int name_count; struct audit_names names[AUDIT_NAMES]; + int react_count; + u32 react[AUDIT_MAX_REACTS]; char * filterkey; /* key for rule that triggered record */ struct path pwd; struct audit_context *previous; /* For nested syscalls */ @@ -622,6 +624,7 @@ static int audit_filter_rules(struct task_struct *tsk, result = audit_comparator(ctx->argv[f->type-AUDIT_ARG0], f->op, f->val); break; case AUDIT_FILTERKEY: + case AUDIT_REACTION: /* ignore this field for filtering */ result = 1; break; @@ -642,6 +645,9 @@ static int audit_filter_rules(struct task_struct *tsk, if (ctx) { if (rule->prio <= ctx->prio) return 0; + ctx->react_count = rule->react_count; + for (i = 0; i < ctx->react_count; i++) + ctx->react[i] = rule->react[i]; if (rule->filterkey) { kfree(ctx->filterkey); ctx->filterkey = kstrdup(rule->filterkey, GFP_ATOMIC); @@ -1332,6 +1338,19 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts context->fsgid = cred->fsgid; context->personality = tsk->personality; + if (context->react_count) { + ab = audit_log_start(context, GFP_KERNEL, AUDIT_REACT_RULE); + if (!ab) + return; + for (i = 0; i < context->react_count; i++) { + if (!i) + audit_log_format(ab, "react=%u", context->react[i]); + else + audit_log_format(ab, " react=%u", context->react[i]); + } + audit_log_end(ab); + } + ab = audit_log_start(context, GFP_KERNEL, AUDIT_SYSCALL); if (!ab) return; /* audit_panic has been called */ @@ -1645,6 +1664,7 @@ void audit_syscall_entry(int arch, int major, void audit_finish_fork(struct task_struct *child) { + int i; struct audit_context *ctx = current->audit_context; struct audit_context *p = child->audit_context; if (!p || !ctx) @@ -1658,6 +1678,9 @@ void audit_finish_fork(struct task_struct *child) p->dummy = ctx->dummy; p->in_syscall = ctx->in_syscall; p->filterkey = kstrdup(ctx->filterkey, GFP_KERNEL); + p->react_count = ctx->react_count; + for (i = 0; i < p->react_count; i++) + p->react[i] = ctx->react[i]; p->ppid = current->pid; p->prio = ctx->prio; p->current_state = ctx->current_state; -- 1.6.4.4

16 years

2
2
0 / 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Linux-audit March 2010