Re: AUDIT_NETFILTER_PKT message format
On Monday, February 13, 2017 3:50:05 PM EST Richard Guy Briggs wrote:
> > > > The alternatives that I currently see are to drop
packets for which
> > > > there is no local process ownership, or to leave the ownership
> > > > fields unset.
> > >
> > > What ownership fields are we talking about?
> >
> > The ones you want, auid, pid, ses. Perhaps I'm using the wrong
> > terminology. What technical term is there for the collection of subject
> > identifiers?
>
> Subject attributes.
Ah ok, I'll try to remember to use that term...
Now that you know what I'm talking about, can you go back and answer the
questions I had about packet "ownership" (which is really packet subject
attributes)?
The format for subject attributes would be:
pid, uid, auid, ses, subj, comm, exe, ...then whatever else you want to add
This also goes for the netfilter_cfg events.
If we have that information, how to we include it in the
message format? And if we don't have it, do we ignore the packet, or do
we swing fields out, or do we set those fields to "unset" or do we use
an auxiliary record?
If you have this for the majority of events, I'd say leave it unset when you
don't. We really don't care about packets that simply transit through the
system. Also, I suppose it depends on what kind of packet it is. For example,
a icmp echo sent to the machine that is blocked is obviously not going to have
an owner. But one originating in the machine heading out should.
-Steve