Re: Explanation of audit message
Hello,
Was looking in the moderator queue and just noticed this message and approved
it.
On Friday, February 2, 2024 10:22:17 AM EDT maupertuis.philippe(a)free.fr
wrote:
Hello list,
I have some auditd messages like
----
node=xxxxxxxx type=PROCTITLE msg=audit(11/07/2023 15:07:37.822:236474) :
proctitle=(systemd)
node= xxxxxxxx type=SYSCALL msg=audit(11/07/2023 15:07:37.822:236474) :
arch=x86_64 syscall=socket success=yes exit=12 a0=inet a1=SOCK_DGRAM a2=ip
a3=0x7ff7d8a40740 items=0 ppid=1 pid=3394229 auid=abcdef uid= abcdef
gid=aqwzsx euid= abcdef suid= abcdef fsuid= abcdef egid= aqwzsx sgid=
aqwzsx fsgid= aqwzsx tty=(none) ses=2284 comm=systemd
exe=/usr/lib/systemd/systemd key=external-access
----
Which are generated by the rule:
-a always,exit -F arch=b64 -S socket,connect -F a0=0x2 -F auid>=1000 -F
auid!=-1 -F key=external-access
Where can I find the description of the message ?
Specifically, what mean exit=12 and a2=ip and a3=0x7ff7d8a40740
This (12) is the descriptor number returned by the socket syscall. A2 is the
protocol as returned by getprotobynumber which uses /etc/protocols to look it
up. A3 is not used by socket and is random stack data. The original call
probably looked like:
s = socket(AF_INET, SOCK_DGRAM, IPPROTO_IP);
IOW, it's making a socket for UDP data.
-Steve