Re: auditd and CAP_AUDIT_READ

> I thought that the prime audit connection requires a capability > check to ensure a process without proper privilege does not replace > the audit daemon...since that's now possible. Are there privilege > checks for who can connect to the audit socket? Shouldn't that > process also have CAP_AUDIT_READ since that is what it will be > doing? The only cap that will let a daemon be checked for replacement is CAP_AUDIT_CONTROL. CAP_AUDIT_READ is only used for the unreliable reception of multicast audit log records. The unicast socket is gated by CAP_AUDIT_CONTROL and CAP_AUDIT_WRITE. The multicast read-only unreliable socket is gated by CAP_AUDIT_READ.