Re: Absolute path names in PATH records

On Mon, 2007-07-02 at 20:44 +0100, Matthew Booth wrote: There has been a lot of work in this area to improve the reporting of path information. First I want to call your attention to the fact audit information is emitted as independent records comprising a single audit event. The best way to think of a record is that it is a single audit message and/or a single line in a log file. If you are only looking at individual records instead of all the records constituting an event you may be missing information. For instance the path information is emitted in a separate record. The audit parsing library (auparse) can reassemble independent records into a single event (but currently only if the records occur sequentially, non-sequential record assembly is a future feature). The ability of the kernel to emit audit records with path information has been evolving in different kernel versions. I'm sorry but I don't have detailed version information on some of this. The AUDIT_AVC_PATH record was added to give complete path information in conjunction with an AUDIT_AVC record (i.e. these two records are members of a single audit event). However in RHEL 5.1, kernel 2.6.22 the AUDIT_AVC_PATH record is going away and the path instead will be in the avc record. I'm not 100% positive, but I believe the work done to support AUDIT_AVC_PATH by capturing path information prior to sys call transition where only the inode is passed to the kernel will now result in complete path information in other audit records as well, perhaps Steve Grubb can give precise information on this. Bottom line: It is recognized better path information is needed, different audit/kernel versions have different support so it's a version sensitive issue, and you must parse audit information as complete events and not individual records. -- John Dennis <jdennis(a)redhat.com&gt;