5:10 p.m.
Hi folks - I'm trying to get the audit tools running on SuSE 10.0...
From the list traffic, it seems that only RHEL4 and FC4 kernels have the
latest patches applied to support the latest auditd, so I retrieved
and built kernel-2.6.14-1.1656_FC4.src.rpm for my system, but I'm still
getting the same "Invalid argument" when I try to do 'auditctl -w
file':
(same error message I get with the stock SuSE 10.0 kernel and the SuSE
10.0 pre-packaged audit-1.0.3-2 tools/libraries)
---
linux:/home/rgiles # auditctl -s
AUDIT_STATUS: enabled=1 flag=1 pid=6342 rate_limit=0 backlog_limit=64 lost=0 backlog=0
linux:/home/rgiles # auditctl -w /etc/shadow
Error sending watch insert request (Invalid argument)
---
On startup, I see this from the kernel:
---
audit: initializing netlink socket (disabled)
audit(1138207304.552:1): initialized
---
/var/log/audit/audit.log reads:
---
type=DAEMON_START msg=audit(1138229931.984:4606) auditd start, ver=1.1.3, format=raw,
auid=4294967295 res=success, auditd pid=6370
type=CONFIG_CHANGE msg=audit(1138229931.985:5): audit_enabled=1 old=1 by auid=4294967295
---
Any pointers would be greatly appreciated (and I apologize for bothering
y'all with usability questions on what appears to be a kernel devel
list... comp.os.linux.suse is full of LAuS questions, but nothing
pertaining to the built-in kernel auditing that y'all are working on).
-----------------------------------------------------------
Robert Giles Group System Administrator
SPD/ARL:UT (512) 835-3077 � Fax (512) 490-4244
7:51 p.m.
On Wednesday 25 January 2006 18:10, Robert Giles wrote:
From the list traffic, it seems that only RHEL4 and FC4 kernels have
the
latest patches applied to support the latest auditd, so I retrieved
and built kernel-2.6.14-1.1656_FC4.src.rpm for my system, but I'm still
getting the same "Invalid argument" when I try to do 'auditctl -w
file':
You're brave mixing and matching kernels. :) For FC4 and RHEL4, the 1.0.x
series matches the kernels. The 1.1 and higher is the development branch
meant for newer kernels.
The "-w" argument doesn't work for any kernels except RHEL4 at this moment.
We
ran into a conflict when sending it upstream and they wanted it re-written to
use inotify hooks. That work is nearing completion, but still has lots of
testing to go.
(same error message I get with the stock SuSE 10.0 kernel and the
SuSE
10.0 pre-packaged audit-1.0.3-2 tools/libraries)
I'd use 1.0.12. That is the state of the art for FC4 and RHEL4. Its also what
I've recommended to Suse for the time being. I am working on back porting
some bug fixes into a 1.0.13 release some time soon.
-Steve
4:38 p.m.
On Wed, 25 Jan 2006, Steve Grubb wrote:
You're brave mixing and matching kernels. :) For FC4 and RHEL4,
the 1.0.x
series matches the kernels. The 1.1 and higher is the development branch
meant for newer kernels.
Well I'm keeping the SuSE 10 /proc/config.gz intact... just trying out
different kernel source trees with that same .config file.
Where do you all keep the development audit patch tree? (in case I was
inclined to continue using bleeding edge code :)
I downloaded and built kernel-2.6.15-1.1826.2.10.2.2_FC5.lspp.6.src.rpm
from David Woodhouse's site, but still wasn't able to get -w working
with 1.1.3.
The "-w" argument doesn't work for any kernels except
RHEL4 at this moment. We
ran into a conflict when sending it upstream and they wanted it re-written to
use inotify hooks. That work is nearing completion, but still has lots of
testing to go.
Gotcha (kept thinking I was typing the command wrong or something).
I'd use 1.0.12. That is the state of the art for FC4 and RHEL4.
Its also what
I've recommended to Suse for the time being. I am working on back porting
some bug fixes into a 1.0.13 release some time soon.
Great, I'll try that tomorrow with the FC4 kernel - thanks a bunch for
the help!
-----------------------------------------------------------
Robert Giles Group System Administrator
SPD/ARL:UT (512) 835-3077 � Fax (512) 490-4244
4:49 p.m.
On Thursday 26 January 2006 17:38, Robert Giles wrote:
Where do you all keep the development audit patch tree? (in case I
was
inclined to continue using bleeding edge code :)
We are sort of in a transition phase right now. David's tree is relatively
current...but oopses. I put what I'm testing at
http://people.redhat.com/sgrubb/files You can build that kernel, but it
doesn't have anything that will make "-w" work.
Unfortunately, only the RHEL4 kernels have the right patches to make "-w"
work. We should have something you can test in the next week or two (or
three). Keep an eye on this mail list, it will be announced when we have new
test kernels. The patches are getting there...
-Steve
10:41 a.m.
On 1/25/06, Robert Giles <rgiles(a)arlut.utexas.edu> wrote:
comp.os.linux.suse is full of LAuS questions, but nothing
pertaining to the built-in kernel auditing that y'all are working on).
LAuS (Linux Audit Subsystem) is an entirely different in-kernel
auditing system co-developed between primarily SuSE and IBM. Although
it did ship in t never made it into the upstream kernel due to a few
hurdles that were not cleared.
LAF (Linux Audit Framework) is the focus of this list. It is in the
upstream kernel and it's the audit system used in RHEL/FC kernels.
This list is where we're discussing both the userspace and kernelspace
aspects of current audit enhancements prior to submitting those
upstream.
:-Dustin
8:32 p.m.
On Wed, Jan 25, 2006 at 05:10:04PM -0600, Robert Giles wrote:
Hi folks - I'm trying to get the audit tools running on SuSE
10.0...
From the list traffic, it seems that only RHEL4 and FC4 kernels have the
latest patches applied to support the latest auditd, so I retrieved
and built kernel-2.6.14-1.1656_FC4.src.rpm for my system, but I'm still
getting the same "Invalid argument" when I try to do 'auditctl -w
file':
1.1.3 is in the build system as of sometime last week, I forget when.
It might be visible in OpenSUSE as of now. It'll be in SL10.1 and SLES10.
Kotd is tracking 2.6.16 git so anything thats upstream will be in that
kernel, not sure if that helps you any.
Tony
6818
days inactive
6820
days old
linux-audit@lists.linux-audit.osci.io
5 comments
4 participants
participants (4)
-
Dustin Kirkland -
Robert Giles -
Steve Grubb -
Tony Jones