audit-1.7.15 released

audit-1.7.15 released

[Steve Grubb]

Hi,

I've just released a new version of the audit daemon. It can be downloaded 
from http://people.redhat.com/sgrubb/audit. It will also be in rawhide  
soon. The ChangeLog is:

- In audisp-remote, add a sigchld handler
- In auditd, check for duplicate remote connections before accepting
- Remove trailing ':' if any are at the end of acct fields in ausearch
- Update remote logging code to do better sanity check of data
- Fix audisp-prelude to prefer files if multiple path records are encountered

Audisp-remote was leaving zombie processes when one of the _action config 
optins was set to exec. Auditd was also not checking for duplicate connections 
from the same machine before accepting.

There were a couple networking packet length check problems reported by 
Sebastian Krahmer of Suse. The most serious issue was in the gssapi code. 
After checking with other distributions, none had enabled this code. So, 
likely this is not a problem for most people. If you roll your own package and 
enable gssapi support, it is recommended for you to upgrade. The main issue 
was that the packet length from the network packet itself was not sanitized 
before trusting. Its believed that this will eventually lead to a problem in 
the kerberos libraries. A few other places in the code were found to be 
trusting the packet length. Analysis found that nothing bad happens in these 
other places. They would all eventually lead to a read of 0 length and auditd 
will disconnect without logging the malicious event. It should be pointed out 
that if you use remote logging, you want to specify the tcp_client_ports to be 
< 1024 to make sure only processes with CAP_NET_BIND_SERVICE can send audit 
events.

Ausearch now trims ':' from acct records in AUDIT_LOGIN events so that it can 
be interpreted correctly, and the audisp-prelude plugin was chosing the first 
audit record when multiple path records are in the same event. In many cases 
this would be a directory, but we now look for the record who's mode field 
indicates that the object is a file.

Please let me know if you run across any problems with this release.

-Steve