Re: aulast only displaying reboot pseudo-users
On Sat, 2014-06-14 at 13:53 +0200, Laurent Bigonville wrote:
Le Thu, 5 Jun 2014 19:34:04 +0200,
Laurent Bigonville <bigon(a)debian.org> a écrit :
> Le Wed, 04 Jun 2014 19:04:52 -0400,
> Steve Grubb <sgrubb(a)redhat.com> a écrit :
[...]
> > You are missing a type=LOGIN event right here. If you do a "cat
> > /proc/self/loginuid" and its set to something besides -1, we have a
> > kernel bug.
> >
>
>
> Actually, my grepping was wrong, I'm seeing this the following line
> too:
>
> type=LOGIN msg=audit(1401921359.597:1397): pid=15760 uid=0
> old-auid=4294967295 new-auid=1002 old-ses=4294967295 new-ses=66 res=1
Any idea here then?
Regarding "/proc/self/loginuid" it's always set to the uid of the user
here.
Looking at aulast code, I can see that there are differences for
kernels before or after 3.13. My machine is running 3.14, could this be
related?
Back in the olden-days we had:
"pid=%d uid=%u old auid=%u new auid=%u old ses=%u new ses=%u res=%d"
Which got complained about and resulted in:
commit 5ee9a75c9fdaebd3ac8176f9f5c73fdcd27c1ad1
Author: Richard Guy Briggs <rgb(a)redhat.com>
Date: Wed Dec 11 15:28:09 2013 -0500
audit: fix dangling keywords in audit_log_set_loginuid() output
Which gave us:
"pid=%d uid=%u old-auid=%u new-auid=%u old-ses=%u new-ses=%u res=%d"
And that is your record type.
Steve asked Richard to remove the "new-" from the fields which resulted
in
commit aa589a13b5d00d3c643ee4114d8cbc3addb4e99f
Author: Richard Guy Briggs <rgb(a)redhat.com>
Date: Mon Feb 24 12:31:11 2014 -0500
audit: remove superfluous new- prefix in AUDIT_LOGIN messages
Which got us to today's record type:
"pid=%d uid=%u subj=%s old-auid=%u auid=%u old-ses=%u ses=%u res=%d"
My guess is that userspace just throws away record where it doesn't find
the auid= and ses= and you kernel happens to live in those couple of
months were it had "new-ses" and "new-auid"
I'd call this a pretty clear userspace bug where it just completely
drops records, even if it can't parse them...