Re: Couldn't get audit messages for 'listen' on kernel 4.19.0-6-686-pae

Hello there! First of all, I have to apologize for two identical emails as the beginning of the stream. The first one was sent (by occasional) from my work email. I've received notification, from the mail bot, that I should subscribe to the mail list (for the work email). After that I've resent the second one. Let's return to the problem. I've done a following experiment: `auditctl -D` `auditctl -a always,exit -S all` `strace netcat -v -l -p 4242 | tee strace.log` # the pid of the netcat was 536 Ctrl+c `ausearch -p 536 > auditd.pid.536.log` `grep "syscall=.*traditional" auditd.pid.536.log | awk '{print $4}' | sort | uniq -c' The last command prints the following result:      11 syscall=102       1 syscall=11       6 syscall=125       6 syscall=140       6 syscall=174       1 syscall=175      14 syscall=192      33 syscall=195       9 syscall=197       2 syscall=20       1 syscall=243       1 syscall=27      41 syscall=295      14 syscall=3       5 syscall=33       2 syscall=4       5 syscall=45      11 syscall=6       3 syscall=91 So the following syscalls are reported (there are no `socket`, `bind`, `connect`, `listen`):     3 (read)     4 (write)     6 (close)     11 (execve)     20 (getpid)     27 (alarm)     33 (access)     45 (brk)     91 (munmap)   102 (socketcall)   125 (mprotect)   140 (_llseek)   174 (rt_sigaction)   175 (rt_sigprocmask)   192 (mmap2)   195 (stat64)   197 (fstat64)   243 (set_thread_area)   295 (openat) But strace's log shows that `socket`, `bind`, `connect` and `listen` were called:     execve("/usr/bin/netcat", ["netcat", "-v", "-l", "-p", "4242"], 0xbf9f8f00 /* 22 vars */) = 0     -- line skipped --     socket(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 3     connect(3, {sa_family=AF_UNIX, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)     close(3)                                = 0     -- line skipped --     socket(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 3     connect(3, {sa_family=AF_UNIX, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)     close(3)                                = 0     -- line skipped --     socket(AF_INET, SOCK_STREAM, IPPROTO_TCP) = 3     setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0     setsockopt(3, SOL_SOCKET, SO_REUSEPORT, [1], 4) = 0     bind(3, {sa_family=AF_INET, sin_port=htons(4242), sin_addr=inet_addr("0.0.0.0")}, 16) = 0     listen(3, 1)                            = 0     getsockname(3, {sa_family=AF_INET, sin_port=htons(4242), sin_addr=inet_addr("0.0.0.0")}, [16]) = 0     -- line skipped -- Please, give me a clue! How could it be? Best regards Rinat On 22.10.2023 08:27, Rinat Gadelshin wrote: