Re: OBJ_PID records

Started playing with this today, with no audit rules i was unable to trigger the OBJ_PID issue. With a single syscall audit rule -a entry,always -S adjtimex -S settimeofday -k time-change i was unable to trigger the problem (might have just not left it long enough, going back and trying again). With a single file watch I was able to trigger the problem. [root@dhcp59-192 audit]# auditctl -l LIST_RULES: exit,always watch=/etc/localtime perm=wa key=time-change [root@dhcp59-192 audit]# for i in `seq 1 500`; do load_policy; done & [1] 17639 [root@dhcp59-192 audit]# for i in `seq 1 50`; do sleep 5; ausearch -m OBJ_PID; done & [2] 17644 [root@dhcp59-192 audit]# <no matches> <no matches> <no matches> <no matches> <no matches> <no matches> <no matches> <no matches> ---- time->Fri Sep 28 06:02:50 2007 type=OBJ_PID msg=audit(1190973770.581:4409): opid=1956 obj=system_u:system_r:syslogd_t:s0 type=SYSCALL msg=audit(1190973770.581:4409): arch=c000003e syscall=1 success=yes exit=3893128 a0=4 a1=2ae984eee000 a2=3b6788 a3=0 items=0 ppid=17639 pid=17686 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 comm="load_policy" exe="/usr/sbin/load_policy" subj=root:system_r:unconfined_t:s0-s0:c0.c1023 key=(null) type=MAC_POLICY_LOAD msg=audit(1190973770.581:4409): policy loaded auid=4294967295 Interestingly on this machine the opid has ALWAYS been 1956 with obj=syslogd_t. I don't however think there is anything special about syslog though as that wasn't the obj in the messages sgrubb was getting, although i do wonder if it was the same opid every time..... -Eric On Fri, 2007-09-21 at 15:06 -0400, Steve Grubb wrote: