June 2010 - Linux-audit - Linux-Audit List Archives

by LC Bruzenak

I know I can go look at the code, however I figured I'd ask here first about the limits on the user message in both audit_log_user_message and ausearch. With audit_log_user_message the maximum length allowed appears to be around MAX_AUDIT_MESSAGE_LENGTH-100. I think it may depend on the executable name length (and other stuff auto-pushed into the string) which is why I say "around". Even when I get a successful return value (from audit_log_user_message), I don't get my string back out in "ausearch" unless it is WAY smaller - ~1K or less I think. Any ideas/thoughts? This is the latest (1.7.11-2) audit package. Thx, LCB. -- LC (Lenny) Bruzenak lenny(a)magitekltd.com

10 years, 8 months

5
17
0 / 0

AUDIT_SIGNAL_INFO

by Matthew Booth

Under what circumstances will the RHEL 4 kernel generate a message of type AUDIT_SIGNAL_INFO? My understanding is that it should be sent when a process sends a signal to the audit daemon, however I have not observed that. Any ideas? Thanks, Matt -- Matthew Booth, RHCA, RHCSS Red Hat, Global Professional Services M: +44 (0)7977 267231 GPG ID: D33C3490 GPG FPR: 3733 612D 2D05 5458 8A8A 1600 3441 EA19 D33C 3490

11 years, 11 months

3
4
0 / 0

Near Term Audit Road Map

by Steve Grubb

Hi, With the proposals sent to the list, I wanted to talk about how this might play out code-wise. With regard to the current code base, I am working on a 1.8 release. This would represent finishing the remote logging app and nothing more. The 1.8 series would become just an update series just like the 1.0.x series did. In parallel with finishing remote logging, I would release a 2.0 version. Patches applied to 1.8 would also be applied to 2.0. A 2.1 release would signify the completion of remote logging that branch. I would recommend this branch for all distributions pulling new code in. The 2.0 branch will also have a couple more changes. I want to split up the audit source code a little bit. I want to drop the system-config-audit code and let it become standalone package updated and distributed separately. I also want to drop all audispd-plugins in the 2.0 branch and have them released separately. They cause unnecessary build dependencies for the audit package. During the work for a 2.2 release, I would also like to pull the audispd program inside auditd. In the past, I tried to keep auditd lean and single purpose, but with adding remote logging and kerberos support, we already have something that is hard to analyze. So, to improve performance and decrease system load, the audit daemon will also do event dispatching. Would this proposal impact anyone in a Bad Way? Thanks, -Steve

11 years, 11 months

4
11
0 / 0

missing user authentication events.

by Robert Harris

12 years, 5 months

3
5
0 / 0

ausearch

by Pittigher, Raymond - CS

I see that the -w or --word switch was added to the ausearch but how it it used? The man pages claim: String based matches must match the whole word. But I have been trying ausearch -w failed and variation of that but only get the message ausearch -if audit.log.3 -w failed failed is an unsupported option This e-mail and any files transmitted with it may be proprietary and are intended solely for the use of the individual or entity to whom they are addressed. If you have received this e-mail in error please notify the sender. Please note that any views or opinions presented in this e-mail are solely those of the author and do not necessarily represent those of ITT Corporation. The recipient should check this e-mail and any attachments for the presence of viruses. ITT accepts no liability for any damage caused by any virus transmitted by this e-mail.

13 years, 6 months

3
2
0 / 0

Re: [PATCH] Audit: Use nlmsg_len() and aggregate into one place.

by Eric Paris

2010/6/29 Tetsuo Handa <penguin-kernel(a)i-love.sakura.ne.jp>: > [PATCH] Audit: Use nlmsg_len() and aggregate into one place. > > AUDIT_SET and AUDIT_TTY_SET should use nlmsg_len() rather than nlh->nlmsg_len . > > AUDIT_MAKE_EQUIV should do "signed int" comparison rather than "unsigned int" > comparison because nlmsg_len() (which is nlh->nlmsg_len - NLMSG_HDRLEN) might > return negative value. > > Also aggregate several nlmsg_len(nlh) calls into one place on the assumption > that nlh->nlmsg_len does not change. > > Totally untested. Please review and test. > > Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Acked-by: Eric Paris <eparis(a)redhat.com> > --- > kernel/audit.c | 20 +++++++++++--------- > 1 file changed, 11 insertions(+), 9 deletions(-) > > --- linux-2.6.35-rc3.orig/kernel/audit.c > +++ linux-2.6.35-rc3/kernel/audit.c > @@ -662,6 +662,7 @@ static int audit_receive_msg(struct sk_b > struct audit_sig_info *sig_data; > char *ctx = NULL; > u32 len; > + int data_len; > > err = audit_netlink_ok(skb, msg_type); > if (err) > @@ -684,6 +685,7 @@ static int audit_receive_msg(struct sk_b > sid = NETLINK_CB(skb).sid; > seq = nlh->nlmsg_seq; > data = NLMSG_DATA(nlh); > + data_len = nlmsg_len(nlh); > > switch (msg_type) { > case AUDIT_GET: > @@ -698,7 +700,7 @@ static int audit_receive_msg(struct sk_b > &status_set, sizeof(status_set)); > break; > case AUDIT_SET: > - if (nlh->nlmsg_len < sizeof(struct audit_status)) > + if (data_len < sizeof(struct audit_status)) > return -EINVAL; > status_get = (struct audit_status *)data; > if (status_get->mask & AUDIT_STATUS_ENABLED) { > @@ -759,7 +761,7 @@ static int audit_receive_msg(struct sk_b > int size; > > audit_log_format(ab, " msg="); > - size = nlmsg_len(nlh); > + size = data_len; > if (size > 0 && > ((unsigned char *)data)[size - 1] == '\0') > size--; > @@ -771,7 +773,7 @@ static int audit_receive_msg(struct sk_b > break; > case AUDIT_ADD: > case AUDIT_DEL: > - if (nlmsg_len(nlh) < sizeof(struct audit_rule)) > + if (data_len < sizeof(struct audit_rule)) > return -EINVAL; > if (audit_enabled == AUDIT_LOCKED) { > audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE, pid, > @@ -785,12 +787,12 @@ static int audit_receive_msg(struct sk_b > /* fallthrough */ > case AUDIT_LIST: > err = audit_receive_filter(msg_type, NETLINK_CB(skb).pid, > - uid, seq, data, nlmsg_len(nlh), > + uid, seq, data, data_len, > loginuid, sessionid, sid); > break; > case AUDIT_ADD_RULE: > case AUDIT_DEL_RULE: > - if (nlmsg_len(nlh) < sizeof(struct audit_rule_data)) > + if (data_len < sizeof(struct audit_rule_data)) > return -EINVAL; > if (audit_enabled == AUDIT_LOCKED) { > audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE, pid, > @@ -804,7 +806,7 @@ static int audit_receive_msg(struct sk_b > /* fallthrough */ > case AUDIT_LIST_RULES: > err = audit_receive_filter(msg_type, NETLINK_CB(skb).pid, > - uid, seq, data, nlmsg_len(nlh), > + uid, seq, data, data_len, > loginuid, sessionid, sid); > break; > case AUDIT_TRIM: > @@ -819,11 +821,11 @@ static int audit_receive_msg(struct sk_b > case AUDIT_MAKE_EQUIV: { > void *bufp = data; > u32 sizes[2]; > - size_t msglen = nlmsg_len(nlh); > + size_t msglen = data_len; > char *old, *new; > > err = -EINVAL; > - if (msglen < 2 * sizeof(u32)) > + if (data_len < 2 * sizeof(u32)) > break; > memcpy(sizes, bufp, 2 * sizeof(u32)); > bufp += 2 * sizeof(u32); > @@ -900,7 +902,7 @@ static int audit_receive_msg(struct sk_b > struct audit_tty_status *s; > struct task_struct *tsk; > > - if (nlh->nlmsg_len < sizeof(struct audit_tty_status)) > + if (data_len < sizeof(struct audit_tty_status)) > return -EINVAL; > s = data; > if (s->enabled != 0 && s->enabled != 1) > -- > To unsubscribe from this list: send the line "unsubscribe linux-security-module" in > the body of a message to majordomo(a)vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html >

13 years, 10 months

1
0
0 / 0

Re: Syscall List

by List Quest

Hi; Thank you very much. This rule file very useful for me. Best Regards. On Wed, Jun 23, 2010 at 2:42 PM, Ashok Kumar J <ashok.jagathesan(a)gmail.com>wrote: > hi, > > Yes you can use the option "-S all". but in more detail just refer the > attachment file. or u can replace your audit rule file. This file is only > for i386 machine. > > > On Wed, Jun 23, 2010 at 4:58 PM, List Quest <listquest(a)gmail.com> wrote: > >> Hi; >> >> Thank you very much. I see all list, very good. >> >> I think "-S all" use, for all system activity; but this is absurd? And, >> this is load to system? >> >> Best Regards >> >> >> >> >> On Wed, Jun 23, 2010 at 2:16 PM, Ashok Kumar J < >> ashok.jagathesan(a)gmail.com> wrote: >> >>> issue the command ausyscall --dump. This will give you architecture >>> specific system calls. >>> >>> On Wed, Jun 23, 2010 at 4:39 PM, List Quest <listquest(a)gmail.com> wrote: >>> >>>> Hi; >>>> >>>> Where find the ALL RHEL 5.x syscall names/lists, fro use auditctl with >>>> -S parameter? >>>> >>>> I found this URL, but maybe short? >>>> http://osinside.net/syscall/system_call_table.htm >>>> >>>> >>>> Thanks >>>> Best Regards >>>> >>>> -- >>>> Linux-audit mailing list >>>> Linux-audit(a)redhat.com >>>> https://www.redhat.com/mailman/listinfo/linux-audit >>>> >>> >>> >>> >>> -- >>> with regards >>> >>> Ashok Kumar J >>> >>> >> > > > -- > with regards > > Ashok Kumar J > >

13 years, 11 months

1
0
0 / 0

Re: Syscall List

by List Quest

Hi; Thank you very much. I see all list, very good. I think "-S all" use, for all system activity; but this is absurd? And, this is load to system? Best Regards On Wed, Jun 23, 2010 at 2:28 PM, List Quest <listquest(a)gmail.com> wrote: > Hi; > > Thank you very much. I see all list, very good. > > I think "-S all" use, for all system activity; but this is absurd? And, > this is load to system? > > Best Regards > > > > > On Wed, Jun 23, 2010 at 2:16 PM, Ashok Kumar J <ashok.jagathesan(a)gmail.com > > wrote: > >> issue the command ausyscall --dump. This will give you architecture >> specific system calls. >> >> On Wed, Jun 23, 2010 at 4:39 PM, List Quest <listquest(a)gmail.com> wrote: >> >>> Hi; >>> >>> Where find the ALL RHEL 5.x syscall names/lists, fro use auditctl with -S >>> parameter? >>> >>> I found this URL, but maybe short? >>> http://osinside.net/syscall/system_call_table.htm >>> >>> >>> Thanks >>> Best Regards >>> >>> -- >>> Linux-audit mailing list >>> Linux-audit(a)redhat.com >>> https://www.redhat.com/mailman/listinfo/linux-audit >>> >> >> >> >> -- >> with regards >> >> Ashok Kumar J >> >> >

13 years, 11 months

1
0
0 / 0

Syscall List

by List Quest

Hi; Where find the ALL RHEL 5.x syscall names/lists, fro use auditctl with -S parameter? I found this URL, but maybe short? http://osinside.net/syscall/system_call_table.htm Thanks Best Regards

13 years, 11 months

1
0
0 / 0

Watch a Files to Write

by List Quest

Hi All; I need watch to write operations from all directorys in root(/), but not watch example /proc and /dev paths? Example, i write this rule to audit.rules file; with -w parameter: -w /home -p w -k WriteProcess -w /home -p r -k ReadProcess This is running, but this technic require write all directory names(listed all top directory names from top level root directory). Example: /home, /etc, /opt ... But yet, i need this directory names automatically watch with audit daemon. If adding directory to system, this directory not watching(if not adding manually). e.g. -> user added directory to /testing(mkdir /testing). At work, not watch write permissions, because not defined to audit.rules file. I have try -W parameter, for remove a watch from watching list; after watch / directory with -w. -w / -p w -W /proc But, not working? How to configure /etc/audit/audit.rules file for my request?

13 years, 11 months

1
0
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Linux-audit June 2010