Re: saddr value in connect()
On Mon, 05 May 2014 15:11:56 -0700
lists_todd(a)mac.com wrote:
I have a question about the SOCKADDR token in a SYSCALL record
(syscall 42 -- connect())
Most of my records begin with one of the two values:
saddr=0200
saddr=0100
Followed by the port & IPv4 address or the file path.
saddr is a hex encoded blob that is a struct sockaddr.
QUESTION 1: The file path appears to be NULL terminated. Is this
correct?
Its a socket address structure. It may or may not be null terminated
depending on the socket type.
QUESTION 2: There is often additional characters after the 00
termination (and IP address). Is this just garbage that should be
ignored?
Its other fields in struct sockaddr.
QUESTION 3: Sometimes the first byte in a file path is 00
termination
(e.g., saddr=0100002F…). Does this mean the string is empty and the
content following it is garbage? Or is there a bug that accidentally
prepends the 00 to the front of the saddr sequence?
That would be an abstract af_unix socket.
-Steve
Here is an example:
————————
type=SYSCALL msg=audit(1397089029.264:7407): arch=c000003e syscall=42
success=yes exit=0 a0=3 a1=7fff3a7fdf70 a2=16 a3=7fff3a7fdd20 items=0
ppid=805 pid=1064 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="initctl"
exe="/sbin/initctl" key=(null)
type=SOCKADDR msg=audit(1397089029.264:7407):
saddr=0100002F636F6D2F7562756E74752F75707374617274 ————————
If I assume the first 00 is a bug, the string decodes to
/com/ubuntu/upstart
Thanks,
Todd
PS. uname -r gives 3.13.0-24-generic (though, I think I collected
these logs before the last software update)
--
Linux-audit mailing list
Linux-audit(a)redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit