September 2016 - Linux-audit - Linux-Audit List Archives

[PATCH] audit: always enable syscall auditing when supported and audit is enabled

by Paul Moore

To the best of our knowledge, everyone who enables audit at compile time also enables syscall auditing; this patch simplifies the Kconfig menus by removing the option to disable syscall auditing when audit is selected and the target arch supports it. Signed-off-by: Paul Moore <pmoore(a)redhat.com> --- init/Kconfig | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) diff --git a/init/Kconfig b/init/Kconfig index c24b6f7..d4663b1 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -299,20 +299,15 @@ config AUDIT help Enable auditing infrastructure that can be used with another kernel subsystem, such as SELinux (which requires this for - logging of avc messages output). Does not do system-call - auditing without CONFIG_AUDITSYSCALL. + logging of avc messages output). System call auditing is included + on architectures which support it. config HAVE_ARCH_AUDITSYSCALL bool config AUDITSYSCALL - bool "Enable system-call auditing support" + def_bool y depends on AUDIT && HAVE_ARCH_AUDITSYSCALL - default y if SECURITY_SELINUX - help - Enable low-overhead system-call auditing infrastructure that - can be used independently or with another kernel subsystem, - such as SELinux. config AUDIT_WATCH def_bool y

5 years, 3 months

5
13
0 / 0

How do I get complete list of audit event types

by Satish Chandra Kilaru

Hi I want to understand the logs in /var/log/audit/audit.log. Where can I get complete list of audit event types and what they mean? --Satish Please Donate to www.wikipedia.org

6 years, 5 months

4
5
0 / 0

[PATCH V3 0/3] Add support for session ID user filtering

by Richard Guy Briggs

https://github.com/linux-audit/audit-kernel/wiki/RFE-Session-ID-User-Filter RFE Session ID User Filter https://github.com/linux-audit/audit-kernel/issues/4 RFE: add a session ID filter to the kernel's user filter See also the set of userspace suport patches: Add support for sessionid user filters, sessionid_set and loginuid_set https://www.redhat.com/archives/linux-audit/2016-August/msg00005.html (userspace update expected to be posted 2016-08-18) and the test case: https://github.com/rgbriggs/audit-testsuite/tree/ghak4-test-for-sessionID... This third patch is expected to have a merge conflict with: "audit: add exclude filter extension to feature bitmap" posted on 2016-08-18. Richard Guy Briggs (3): audit: add support for session ID user filter audit: add AUDIT_SESSIONID_SET support audit: add sessionid filter extension to feature bitmap include/linux/audit.h | 10 ++++++++++ include/uapi/linux/audit.h | 6 +++++- kernel/auditfilter.c | 5 +++++ kernel/auditsc.c | 6 ++++++ 4 files changed, 26 insertions(+), 1 deletions(-)

7 years, 5 months

3
11
0 / 0

[userspace PATCH v2 0/3] Add support for sessionid user filters, sessionid_set

by Richard Guy Briggs

Add support for sessionid, sessionid_set (first two patches) and feature bitmap detection of the kernel feature (third patch) in user filters. This is to implement issue "ghak4": https://github.com/linux-audit/audit-kernel/issues/4 https://github.com/linux-audit/audit-kernel/wiki/RFE-Session-ID-User-Filter This patchset should be added after loginuid_set and exclude filter extension to avoid merge conflicts. Richard Guy Briggs (3): Add userspace support for session ID user filter. Add sessionid_set option from kernel uapi macro AUDIT_SESSIONID_SET Check sessionID* fields available in kernel trunk/lib/errormsg.h | 1 + trunk/lib/fieldtab.h | 2 ++ trunk/lib/libaudit.c | 17 +++++++++++++++++ trunk/lib/libaudit.h | 11 +++++++++++ 4 files changed, 31 insertions(+), 0 deletions(-)

7 years, 7 months

3
7
0 / 0

[userspace PATCH v2 0/2] Add support for loginuid_set

by Richard Guy Briggs

loginuid_set support should have been added to userspace when it was added to the kernel around v3.10. Add it before we do similar for sessionID and sessionID_set. There will be a number of users of features_bitmap within the same function (exclude filter extension, sessionID filter), so refactor audit_rule_fieldpair_data() to put audit_get_features earlier in the function. Richard Guy Briggs (2): get feature list only once Add user filter option loginuid_set from uapi macro AUDIT_LOGINUID_SET trunk/lib/errormsg.h | 2 ++ trunk/lib/fieldtab.h | 2 ++ trunk/lib/libaudit.c | 17 ++++++++++++++++- trunk/lib/libaudit.h | 6 ++++++ 4 files changed, 26 insertions(+), 1 deletions(-)

7 years, 7 months

3
20
0 / 0

Question regarding ntpd

by Sullivan, Daniel [CRI]

Hi, I have what I hope to be a quick question regarding auditing ntpd. I am looking at my auditd log file and I see this same entry being repeated every second: type=SYSCALL msg=audit(1475012493.972:5325): arch=c000003e syscall=159 success=yes exit=0 a0=7ffd7498eb00 a1=861 a2=0 a3=1 items=0 ppid=1 pid=5357 auid=4294967295 uid=38 gid=38 euid=38 suid=38 fsuid=38 egid=38 sgid=38 fsgid=38 tty=(none) ses=4294967295 comm="ntpd" exe="/usr/sbin/ntpd" key="time-change" type=SYSCALL msg=audit(1475012494.971:5326): arch=c000003e syscall=159 success=yes exit=0 a0=7ffd7498eb00 a1=861 a2=0 a3=1 items=0 ppid=1 pid=5357 auid=4294967295 uid=38 gid=38 euid=38 suid=38 fsuid=38 egid=38 sgid=38 fsgid=38 tty=(none) ses=4294967295 comm="ntpd" exe="/usr/sbin/ntpd" key="time-change" type=SYSCALL msg=audit(1475012495.972:5327): arch=c000003e syscall=159 success=yes exit=0 a0=7ffd7498eb00 a1=861 a2=0 a3=1 items=0 ppid=1 pid=5357 auid=4294967295 uid=38 gid=38 euid=38 suid=38 fsuid=38 egid=38 sgid=38 fsgid=38 tty=(none) ses=4294967295 comm="ntpd" exe="/usr/sbin/ntpd" key="time-change” This is generating large amounts of log data. I am not an expert in auditd log analysis. Is this expected behavior? I am unsure of what the key time-change value of this log data is, and am wondering if this indicates some sort of misconfiguration or problem with ntpd. From looking at the output of tcpdump it does not look like I am polling every second, so I am wondering why this activity is occurring. If anybody could advise on how to decipher these log entries I would appreciate it. Thank you for your help and advisement. Best, Dan Sullivan ******************************************************************************** This e-mail is intended only for the use of the individual or entity to which it is addressed and may contain information that is privileged and confidential. If the reader of this e-mail message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is prohibited. If you have received this e-mail in error, please notify the sender and destroy all copies of the transmittal. Thank you University of Chicago Medicine and Biological Sciences ********************************************************************************

7 years, 7 months

6
12
0 / 0

[userspace PATCH v2 0/2] add support for more fields to the exclude filter

by Richard Guy Briggs

Add userspace support for the exclude filter extension of subject credentials, including detection of the feature in the kernel. This set should be added after loginuid_set support and before sessionID user filter support to avoid merge conflicts. Richard Guy Briggs (2): exclude filter: add support for user filter fields Check exclude filter cred extension fields available in kernel trunk/docs/auditctl.8 | 2 +- trunk/lib/errormsg.h | 4 ++-- trunk/lib/libaudit.c | 29 +++++++++++++++++++++++++---- trunk/lib/libaudit.h | 3 +++ 4 files changed, 31 insertions(+), 7 deletions(-)

7 years, 7 months

2
5
0 / 0

ausearch checkpoint question

by LC Bruzenak

I'm using the 2.4.5-3 audit rpm set and I tried using the ausearch "checkpoint" option a couple weeks ago. This was on a moderately busy system (judging by my own systems/experience) generating say 300-400MB of data/day. I tried the checkpoint option in a 5-minute cron job, and I noticed that in comparison to the "-ts recent" option, it took far longer to complete. The "recent" option result was less than a second, whereas the checkpoint version took ~20 seconds every 5 minutes. It's possible there were other factors at play; e.g. it was used on a mls-policy machine, and although I saw no AVCs, it's possible there were some access issues I didn't have time to investigate. On my intended application, I'll be on a standard targeted-policy machine so this won't be a potential factor. I need to test this again, as I'm considering using the ausearch checkpoint capability for some new requirements, I was wondering if perhaps there were any timing results done or if there are any tips and tricks to getting the most out of it. Also - the man page section describing this is a little confusing to me so if anyone has a script segment that would be very helpful. Thanks in advance, LCB -- LC Bruzenak magitekltd.com

7 years, 7 months

2
2
0 / 0

The default file for krb5_key_file is missing from the auditd.conf(5) manual

by Mateusz Piotrowski

Hello, See this line[1]. It lacks the name of the default file. As I don't know what the default file is I cannot submit a patch. Hopefully, someone else can fix this file. Cheers! -Mateusz [1]: https://github.com/linux-audit/audit-userspace/blob/master/docs/auditd.co...

7 years, 7 months

2
2
0 / 0

[PATCH] audit: add exclude filter extension to feature bitmap

by Richard Guy Briggs

Add to the audit feature bitmap to indicate availability of the extension of the exclude filter to include PID, UID, AUID, GID, SUBJ_*. RFE: add additional fields for use in audit filter exclude rules https://github.com/linux-audit/audit-kernel/issues/5 Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com> --- include/uapi/linux/audit.h | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h index d820aa9..76c5e7e 100644 --- a/include/uapi/linux/audit.h +++ b/include/uapi/linux/audit.h @@ -327,9 +327,11 @@ enum { #define AUDIT_FEATURE_BITMAP_BACKLOG_LIMIT 0x00000001 #define AUDIT_FEATURE_BITMAP_BACKLOG_WAIT_TIME 0x00000002 #define AUDIT_FEATURE_BITMAP_EXECUTABLE_PATH 0x00000004 +#define AUDIT_FEATURE_BITMAP_EXCLUDE_EXTEND 0x00000008 #define AUDIT_FEATURE_BITMAP_ALL (AUDIT_FEATURE_BITMAP_BACKLOG_LIMIT | \ AUDIT_FEATURE_BITMAP_BACKLOG_WAIT_TIME | \ - AUDIT_FEATURE_BITMAP_EXECUTABLE_PATH) + AUDIT_FEATURE_BITMAP_EXECUTABLE_PATH | \ + AUDIT_FEATURE_BITMAP_EXCLUDE_EXTEND) /* deprecated: AUDIT_VERSION_* */ #define AUDIT_VERSION_LATEST AUDIT_FEATURE_BITMAP_ALL -- 1.7.1

7 years, 7 months

2
1
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Linux-audit September 2016