Steve Grubb wrote: when adding auid filters on watches .. and executing "auditclt -l" I don't see a list of the newly added filter rules ... Is that the behavior you intended? (I am on kernel.65 on i386 system) example # auditctl watch,always -F auid=something # auditctl watch,never -F auid=something # auditctl -l No rules No watches Also .. the above commands don't seem to be actually filtering .. so I don't know if that is because the mechanism might not be working, or maybe the filters aren't getting inserted since I don't see them in the listing .. Thanks, - Loulwa

On Thu, 2005-06-23 at 07:19 -0400, Steve Grubb wrote: I've reproduced something similar, although the machine is far from 'hung'. It seems there was still a case where auditd could still be audited. So all userspace processes will be waiting a minute for every syscall they make, because the backlog timeout happens. If you're running X, that would explain the lack of caps lock. Don't test with X running unless you have a serial console. I'm testing a fix for this now... -- dwmw2

I don't seem to get the filtering on auid to work ... I am attaching a test case so you can see how I am testing this .. I am on kernel.65 and audit 0.9.12 Test strategy: 1- add filter rules for a user 2- add a watch on a file 3- create two temp users (my users have to be in Wheel trusted group in 4- order to ssh into the system .. may not apply to everybody). 5- spawn ssh session user1@localhost and touch the watched file 6- Remove the file(so other user can touch it again) 7- spawn ssh session user2@localhost and touch the watched file 8- stop auditd and copy the audit.log to a temp file (/tmp/loginuid_logs) For Step 1 above, I tried the following scenarios: auditctl -a watch,always -F auid=uid1 auditctl -a watch,never -F auid!=uid1 or auditctl -a watch,always -F auid=uid1 auditctl -a watch,never -F auid=uid2 Neither seems to work .. in the log I still see watch records for open on the watched file generated by both users!! - Loulwa #include <stdio.h> #include <stdlib.h> #include <sys/types.h> #include <sys/stat.h> #include <sys/utsname.h> int uid1=580; int uid2=650; char user1[] = "tmp-user1"; char user2[] = "tmp-user2"; char* password = "eal"; char* encryptedpassword = "42VmxaOByKwlA"; static const char* tempname = "/tmp/testXXXXXX\0"; int rc; int fd1, fd2; /* file descriptor */ char script_cmd1[1000], script_cmd2[1000], exec_cmd[1000]; char *filename1, *filename2; int main(int ac, char **av) { char command[256]; system("/etc/rc.d/init.d/auditd stop"); system("rm -f /var/log/audit/audit.log"); system("rm /tmp/loginuid_logs -f"); system("/etc/rc.d/init.d/auditd start"); /* Create expect script file to execute ftp session */ filename1 = (char *) malloc(strlen(tempname)); strcpy(filename1, tempname); if ((fd1 = mkstemp(filename1)) == -1) { printf("File creation error\n"); } filename2 = (char *) malloc(strlen(tempname)); strcpy(filename2, tempname); if ((fd2 = mkstemp(filename2)) == -1) { printf("File creation error\n"); } /* create test users */ sprintf(command, "/usr/sbin/useradd -u %d -m -G wheel -p %s %s",uid1,encryptedpassword,user1); system(command); sprintf(command, "/usr/sbin/useradd -u %d -m -G wheel -p %s %s",uid2,encryptedpassword,user2); system(command); /* insert watches and filters on loginuid "uid1" */ system("auditctl -w /tmp/file1 -k loginuid-key"); sprintf(command, "auditctl -a watch,always -F auid=%d", uid1); system(command); sprintf(command, "auditctl -a watch,never -F auid!=%d", uid1); //sprintf(command, "auditctl -a watch,never -F auid=%d", uid2); system(command); sprintf(script_cmd1, "expect -c \"spawn /usr/bin/ssh %s@localhost \nsleep 1 \nexpect -re \\\"password: \\\" \nsleep 1 \nsend \\\"%s\\r\\n\\\" \nsleep 1 \nexpect -re \\\"> \\\" \nsleep 1 \nsend \\\"touch /tmp/file1\\r\\n\\\" \nsleep 1 \nsend \\\"exit\\\" \nsend_user \\\"exit\\n\\\"\"", user1, password); sprintf(script_cmd2, "expect -c \"spawn /usr/bin/ssh %s@localhost \nsleep 1 \nexpect -re \\\"password: \\\" \nsleep 1 \nsend \\\"%s\\r\\n\\\" \nsleep 1 \nexpect -re \\\"> \\\" \nsleep 1 \nsend \\\"touch /tmp/file1\\r\\n\\\" \nsleep 1 \nsend \\\"exit\\\" \nsend_user \\\"exit\\n\\\"\"", user2, password); write(fd1, script_cmd1, strlen(script_cmd1)); fchmod(fd1, S_IRWXU | S_IRWXG | S_IRWXO); close(fd1); sprintf(exec_cmd, "/bin/sh -f %s", filename1); system(exec_cmd); system("rm -f /tmp/file1"); sleep(1); write(fd2, script_cmd2, strlen(script_cmd2)); fchmod(fd2, S_IRWXU | S_IRWXG | S_IRWXO); close(fd2); sprintf(exec_cmd, "/bin/sh -f %s", filename2); system(exec_cmd); /* Stop auditd to prevent more log entries. */ sleep(2); system("auditctl -W /tmp/file1"); system("/etc/rc.d/init.d/auditd stop"); system("cat /var/log/audit/audit.log >> /tmp/loginuid_logs"); system("rm -f /tmp/file1"); /* cleanup users and files */ if (filename1 != NULL) { unlink(filename1); free(filename1); } if (filename2 != NULL) { unlink(filename2); free(filename2); } sprintf(command, "/usr/sbin/userdel -r %s", user1); system(command); sprintf(command, "/usr/sbin/userdel -r %s", user2); system(command); }

On Thursday 23 June 2005 14:09, David Woodhouse wrote: I fixed auditctl so that if you do not specify a syscall, it will default to all. I use the following and confirmed that it works (will be in 0.9.13): auditctl -a watch,never -F auid=500 auditctl -w /etc/passwd -k test -p rwxa cat /etc/passwd >/dev/null However...I looked at the user filtering and it is not working. I think I know why. netlink is an async interface. This means that the task may not be alive when the user message is processed. It currently detects the and returns -ESRCH, but the sender is long gone. This means that the generic audit_filter_rules() cannot be used. You can only filter based on the credentials that netlink gathered from the caller at reception of message, or move the filtering to the message entry point after permission checks. -Steve

On Thursday 23 June 2005 17:08, David Woodhouse wrote: uid, pid, and loginuid are the only things collected by netlink for the sender's credentials. Another app could reuse the pid by the time the netlink message is processed. The lookup will succeed, but the check is against the wrong process. We make no requirements for this anywhere else. We just need to filter against the netlink credentials since that is all we know to be true. Yes. -Steve

On Fri, 2005-06-24 at 09:19 -0400, Steve Grubb wrote: Actually we need a 'yes/no/unmatched' answer. We could change it as you suggest, and if we do that we should probably also change audit_filter_rules() in the same fashion -- but let's not bother. -- dwmw2

On Fri, 2005-06-24 at 10:12 -0400, Steve Grubb wrote: That's already implemented. Each _rule_ gives yes/no/unmatched, and what you're saying is that audit_filter_user() should return 1 if all calls to audit_filter_user_rules() have returned 'unmatched'. It's not particularly different at the moment. Changing the prototype for one but not the other would make it gratuitously so, which isn't really an improvement. -- dwmw2