A question on monitoring time or time management changes in the kernel and the adjtimex system call
- First Post
- Replies
- Stats
-
Go to
- ----- 2024 -----
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2023 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2022 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2021 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2020 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2019 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2018 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2017 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2016 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2015 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2014 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2013 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2012 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2011 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2010 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2009 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2008 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2007 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2006 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2005 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2004 -----
- December
- November
- October
- September
- August
All,
Would it be correct to say that when one sees an adjtimex system call audit event, a
change has occurred ONLY if either a AUDIT_TIME_ADJNTPVAL (algorithm change) or
AUDIT_TIME_INJOFFSET (time change) record is present in the event?
Thanks in advance
Burn Alting
Attachments:
- attachment.html (text/html — 427 bytes)
Hello,
On Monday, January 9, 2023 2:33:39 AM EST Burn Alting wrote:
Would it be correct to say that when one sees an adjtimex system call
audit
event, a change has occurred ONLY if either a AUDIT_TIME_ADJNTPVAL
(algorithm change) or AUDIT_TIME_INJOFFSET (time change) record is present
in the event?
I think if you see either, time has been changed. I haven't studied the
syscall to see if there isn't a sneak path, but I think they can be relied
on.
-Steve
On Mon, Jan 9, 2023 at 2:33 AM Burn Alting <burn.alting(a)iinet.net.au> wrote:
All,
Would it be correct to say that when one sees an adjtimex system call audit event, a
change has occurred ONLY if either a AUDIT_TIME_ADJNTPVAL (algorithm change) or
AUDIT_TIME_INJOFFSET (time change) record is present in the event?
Looking at audit_log_time() and audit_tk_injoffset() it appears that
an AUDIT_TIME_INJOFFSET record would indicate a time shift given by
the "sec"/"nsec" fields while an AUDIT_TIME_ADJNTPVAL *might*
indicate
a shift depending on what was adjusted, you probably want to check the
adjtimex(2) manpage, specifically the struct timex definition for more
information on the AUDIT_TIME_ADJNTPVAL "op" field and
"new"/"old"
values.
* https://man7.org/linux/man-pages/man2/adjtimex.2.html
Hopefully that helps a little bit.
--
paul-moore.com
661
days inactive
661
days old
linux-audit@lists.linux-audit.osci.io
2 comments
3 participants
tags (0)
participants (3)
-
Burn Alting -
Paul Moore -
Steve Grubb