June 2011 - Linux-audit - Linux-Audit List Archives

by Pittigher, Raymond - ES

On 06/17/2011 02:56 PM, LC Bruzenak wrote: > On Fri, 2011-06-17 at 14:32 -0400, Pittigher, Raymond - ES wrote: > > > > I also used the au tools (aureport, aufind, etc) but just wanting a > > average user to view the bad events brings the need of a point a click > > interface. > > Agreed. > > > The people that now read the audit events for the windows servers are > > spoiled by the cornerbowl tool. I tossed together a little script that > > dumps the audit events into a array, then sorts them and dumps them > > out but the users want a red background for bad and so on. Before I > > went crazy trying to put something together I wanted to see what was > > out in the wild. I guess something that dumps the files into a MySQL > > tables would be the easiest to work with. > > Then what would you use for visualization? > This week I have been thinking about this very thing myself. > Good to know others are as well. > > LCB > > -- > LC (Lenny) Bruzenak > lenny(a)magitekltd.com > The plan would be to rotate the log at midnight Saturday, use the aureport to read the file and give it some kind of format, dump the data into a mysql database, then parse it with php on a apache server with a firefox front end. Or something like that. This e-mail and any files transmitted with it may be proprietary and are intended solely for the use of the individual or entity to whom they are addressed. If you have received this e-mail in error please notify the sender. Please note that any views or opinions presented in this e-mail are solely those of the author and do not necessarily represent those of ITT Corporation. The recipient should check this e-mail and any attachments for the presence of viruses. ITT accepts no liability for any damage caused by any virus transmitted by this e-mail.

14 years, 1 month

2
2
0 / 0

unsubscribe

by Jack Schaible

CONFIDENTIALITY NOTICE: This e-mail message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.

14 years, 1 month

1
0
0 / 0

log files

by Pittigher, Raymond - ES

What do the users of this list use to read the log files? I have tried Spacewalk (which is nice) but is a lot of software to install to read logs. I have looked at Prewikka but do not have it totally configured yet to give it a OK or not. This e-mail and any files transmitted with it may be proprietary and are intended solely for the use of the individual or entity to whom they are addressed. If you have received this e-mail in error please notify the sender. Please note that any views or opinions presented in this e-mail are solely those of the author and do not necessarily represent those of ITT Corporation. The recipient should check this e-mail and any attachments for the presence of viruses. ITT accepts no liability for any damage caused by any virus transmitted by this e-mail.

14 years, 1 month

4
4
0 / 0

audit-2.1.2 released

by Steve Grubb

Hi, I've just released a new version of the audit daemon. It can be downloaded from http://people.redhat.com/sgrubb/audit. It will also be in rawhide soon. The ChangeLog is: - In ausearch/report, fix a segfault caused by MAC_POLICY_LOAD records - In ausearch/report, add and update parsers - In auditd, cleanup DAEMON_ACCEPT and DAEMON_CLOSE addr fields - In ausearch/report, parse addr field of DAEMON_ACCEPT & DAEMON_CLOSE records - In auditd, move startup success to after events are registered - If auditd shutsdown due to failed tcp init, write a DAEMON_ABORT event - Update auditd to avoid the oom killer in new kernels (Andreas Jaeger) - Parse and interpret NETFILTER_PKT events correctly - Return error if auditctl -l fails (#709345) - In audisp-remote, replace glibc's fgets with custom implementation The bulk of this release is fixing up the parsers for new events. This release also updates the oom handler code for recent kernels. And reliability of logging remote events was improved. Please let me know if you run across any problems with this release. -Steve

14 years, 1 month

2
2
0 / 0

[PATCH 2nd revision] Add SELinux context support to AUDIT target

by Mr Dash Four

Add SELinux context support to AUDIT target (2nd revision). Typical (raw auditd) output after applying this patch would be: type=NETFILTER_PKT msg=audit(1305852240.082:31012): action=0 hook=1 len=52 inif=? outif=eth0 saddr=10.1.1.7 daddr=10.1.2.1 ipid=16312 proto=6 sport=56150 dport=22 obj=system_u:object_r:ssh_packet_t:s0 type=NETFILTER_PKT msg=audit(1306772064.079:56): action=0 hook=3 len=48 inif=eth0 outif=? smac=00:05:5d:7c:27:0b dmac=00:02:b3:0a:7f:81 macproto=0x0800 saddr=10.1.2.1 daddr=10.1.1.7 ipid=462 proto=6 sport=3561 dport=22 obj=system_u:object_r:ssh_packet_t:s0 Signed-off-by: Mr Dash Four <mr.dash.four(a)googlemail.com> --- net/netfilter/xt_AUDIT.c | 15 +++++++++++++++ 1 files changed, 15 insertions(+), 0 deletions(-) diff --git a/net/netfilter/xt_AUDIT.c b/net/netfilter/xt_AUDIT.c index 363a99e..616cadc 100644 --- a/net/netfilter/xt_AUDIT.c +++ b/net/netfilter/xt_AUDIT.c @@ -20,6 +20,9 @@ #include <linux/netfilter/x_tables.h> #include <linux/netfilter/xt_AUDIT.h> #include <linux/netfilter_bridge/ebtables.h> +#ifdef CONFIG_NF_CONNTRACK_SECMARK +#include <linux/security.h> +#endif #include <net/ipv6.h> #include <net/ip.h> @@ -122,6 +125,10 @@ audit_tg(struct sk_buff *skb, const struct xt_action_param *par) { const struct xt_audit_info *info = par->targinfo; struct audit_buffer *ab; +#ifdef CONFIG_NF_CONNTRACK_SECMARK + u32 len; + char *secctx; +#endif ab = audit_log_start(NULL, GFP_ATOMIC, AUDIT_NETFILTER_PKT); if (ab == NULL) @@ -163,6 +170,14 @@ audit_tg(struct sk_buff *skb, const struct xt_action_param *par) break; } +#ifdef CONFIG_NF_CONNTRACK_SECMARK + if (skb->secmark) + if (!security_secid_to_secctx(skb->secmark, &secctx, &len)) { + audit_log_format(ab, " obj=%s", secctx); + security_release_secctx(secctx, len); + } +#endif + audit_log_end(ab); errout: -- 1.7.3.4

14 years, 1 month

5
28
0 / 0

[v2, PATCH 0/2] MIPS syscall auditing patches

by Ralf Baechle

This is the first cut of the MIPS auditing patches. MIPS doesn't quite fit into the existing pattern of other architectures and I'd appreciate your comments and maybe even an Acked-by for the kernel part so I can feed that upstream. Ralf Changes to v2: The kernel patch went stale due to another conflicting patch of myself and Eric's "Audit: push audit success and retcode into arch ptrace.h" patch. Resolved that conflict.

14 years, 1 month

1
2
0 / 0

Re: Possible regression

by Steve Grubb

On Thursday, June 02, 2011 12:41:41 PM 4javier wrote: > root@Archbox /home/javier $ touch /tmp/test > root@Archbox /home/javier $ cat /tmp/test > root@Archbox /home/javier $ auditctl -w /tmp/test -p wa > root@Archbox /home/javier $ echo ppp >> /tmp/test > root@Archbox /home/javier $ cat /tmp/test > ppp > root@Archbox /home/javier $ ausearch -i -f /tmp/test > <no matches> > root@Archbox /home/javier $ auditctl -l > LIST_RULES: exit,always watch=/tmp/test perm=wa > root@Archbox /home/javier $ echo ppp > /tmp/test > root@Archbox /home/javier $ ausearch -i -f /tmp/test > <no matches> > root@Archbox /home/javier $ ausearch -f /tmp/test > <no matches> > > As you can see from auditcrl -l output, rule seems to be correctly set, but > ausearch doesn't show anything. I duplicated your tests here: [root@localhost ~]# auditctl -w /tmp/test -p wa -k watch [root@localhost ~]# echo "ppp" >> /tmp/test [root@localhost ~]# cat /tmp/test ppp [root@localhost ~]# ausearch --start recent -i -f /tmp/test ---- type=PATH msg=audit(06/02/2011 14:32:45.146:112) : item=0 name=/tmp/test inode=164740 dev=fd:01 mode=file,644 ouid=root ogid=root rdev=00:00 obj=unconfined_u:object_r:user_tmp_t:s0 type=CWD msg=audit(06/02/2011 14:32:45.146:112) : cwd=/root type=SYSCALL msg=audit(06/02/2011 14:32:45.146:112) : arch=x86_64 syscall=open success=yes exit=3 a0=1842830 a1=441 a2=1b6 a3=0 items=1 ppid=1298 pid=1304 auid=sgrubb uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts0 ses=1 comm=bash exe=/bin/bash subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=watch Admittedly I am on the 2.6.38.6 kernel. But I'm not seeing a regression. When you set the perms to "wa" that is only going to be opens for writing or changes to file attributes. So, the cat command will not trigger an event and that is why I only get 1 event. I am also on a 64 bit system, but I would think that didn't matter...unless we have a signed/unsigned comparison problem...what do you have for an inode on the /tmp/watch file? ls -i /tmp/watch should get it. -Steve

14 years, 1 month

2
1
0 / 0

Fwd: Possible regression

by 4javier

---------- Forwarded message ---------- From: 4javier <4javiereg4(a)gmail.com> Date: 2011/6/2 Subject: Re: Possible regression To: Steve Grubb <sgrubb(a)redhat.com> root@Archbox /home/javier $ touch /tmp/test root@Archbox /home/javier $ cat /tmp/test root@Archbox /home/javier $ auditctl -w /tmp/test -p wa root@Archbox /home/javier $ echo ppp >> /tmp/test root@Archbox /home/javier $ cat /tmp/test ppp root@Archbox /home/javier $ ausearch -i -f /tmp/test <no matches> root@Archbox /home/javier $ auditctl -l LIST_RULES: exit,always watch=/tmp/test perm=wa root@Archbox /home/javier $ echo ppp > /tmp/test root@Archbox /home/javier $ ausearch -i -f /tmp/test <no matches> root@Archbox /home/javier $ ausearch -f /tmp/test <no matches> As you can see from auditcrl -l output, rule seems to be correctly set, but ausearch doesn't show anything. 2011/6/2 Steve Grubb <sgrubb(a)redhat.com> > On Thursday, June 02, 2011 09:45:38 AM you wrote: > > you're right...sorry for my fault... > > I didn't use the -a switch. I read the man, but I cannot understand how > > this settings is able to fix the problem with O_CREAT. > > Could you explain that to me, please? > > As far as I know, the problem was fixed in 2006 and there has been no > regression. The - > w command is translated into -a always,exit -F path= under the hood. Its > been this way > since watches were deprecated around 2005/2006. > > How were you testing? You might have found a bug and I just don't know how > to > reproduce it. > > -Steve >

14 years, 1 month

1
0
0 / 0

Re: Possible regression

by Steve Grubb

On Thursday, June 02, 2011 09:45:38 AM you wrote: > you're right...sorry for my fault... > I didn't use the -a switch. I read the man, but I cannot understand how > this settings is able to fix the problem with O_CREAT. > Could you explain that to me, please? As far as I know, the problem was fixed in 2006 and there has been no regression. The - w command is translated into -a always,exit -F path= under the hood. Its been this way since watches were deprecated around 2005/2006. How were you testing? You might have found a bug and I just don't know how to reproduce it. -Steve

14 years, 1 month

1
0
0 / 0

Fwd: Possible regression

by 4javier

---------- Forwarded message ---------- From: 4javier <4javiereg4(a)gmail.com> Date: 2011/6/2 Subject: Re: Possible regression To: Steve Grubb <sgrubb(a)redhat.com> you're right...sorry for my fault... I didn't use the -a switch. I read the man, but I cannot understand how this settings is able to fix the problem with O_CREAT. Could you explain that to me, please? 2011/6/2 Steve Grubb <sgrubb(a)redhat.com> > On Thursday, June 02, 2011 08:48:30 AM 4javier wrote: > > I'm noticing exactly the same problem mentioned into this old message > > http://osdir.com/ml/linux.redhat.security.audit/2006-07/msg00036.html > > Workaround consisting into watching the whole directory containing the > file > > works too. I've found that into 2006 a patch was submitted to solve the > > issue > > http://www.mail-archive.com/linux-audit@redhat.com/msg00476.html > > > > Is this a recent regression, or is there something I don't know? > > I just ran the test from that email and got the following: > > [root@localhost ~]# touch /tmp/test > [root@localhost ~]# auditctl -a always,exit -F path=/tmp/test -F perm=rwa > -k watch > [root@localhost ~]# echo "" > /tmp/test > [root@localhost ~]# cat /tmp/test > > [root@localhost ~]# ausearch --start recent --key watch -i > ---- > type=CONFIG_CHANGE msg=audit(06/02/2011 09:15:49.790:124) : auid=sgrubb > ses=2 > subj=unconfined_u:unconfined_r:auditctl_t:s0-s0:c0.c1023 op="add rule" > key=watch > list=exit res=1 > ---- > type=PATH msg=audit(06/02/2011 09:15:56.970:125) : item=0 name=/tmp/test > inode=164740 > dev=fd:01 mode=file,644 ouid=root ogid=root rdev=00:00 > obj=unconfined_u:object_r:user_tmp_t:s0 > type=CWD msg=audit(06/02/2011 09:15:56.970:125) : cwd=/root > type=SYSCALL msg=audit(06/02/2011 09:15:56.970:125) : arch=x86_64 > syscall=open > success=yes exit=3 a0=28cadd0 a1=241 a2=1b6 a3=0 items=1 ppid=1634 pid=1640 > auid=sgrubb uid=root gid=root euid=root suid=root fsuid=root egid=root > sgid=root > fsgid=root tty=pts1 ses=2 comm=bash exe=/bin/bash > subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=watch > ---- > type=PATH msg=audit(06/02/2011 09:16:08.850:126) : item=0 name=/tmp/test > inode=164740 > dev=fd:01 mode=file,644 ouid=root ogid=root rdev=00:00 > obj=unconfined_u:object_r:user_tmp_t:s0 > type=CWD msg=audit(06/02/2011 09:16:08.850:126) : cwd=/root > type=SYSCALL msg=audit(06/02/2011 09:16:08.850:126) : arch=x86_64 > syscall=open > success=yes exit=3 a0=7fffd7a8f943 a1=0 a2=0 a3=32d80819d0 items=1 > ppid=1640 pid=1659 > auid=sgrubb uid=root gid=root euid=root suid=root fsuid=root egid=root > sgid=root > fsgid=root tty=pts1 ses=2 comm=cat exe=/bin/cat > subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=watch > [root@localhost ~]# uname -r > 2.6.38.6-26.rc1.fc15.x86_64 > > We have 2 events. Are you getting this? Is something missing? > > -Steve >

14 years, 1 month

1
0
0 / 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Linux-audit June 2011