* Auditd doesn't receive syscalls after installation for the current shell.
@ 2023-05-24 11:37 ` Rinat Gadelshin
0 siblings, 0 replies; 8+ messages in thread
From: Rinat Gadelshin @ 2023-05-24 11:37 UTC (permalink / raw)
To: linux-audit; +Cc: audit
Hello there.
It seems that the kernel doesn't send messages for syscalls of the shell
process from which auditd is installed.
Reproducing steps (performed on Ubuntu 22.04 x86_64 on virtual box by
`root`):
step #1: $ apt install auditd
step #2: $ auditctl -a always,exit -F arch=b64 -S openat,renameat2,unlinkat
step #3: $ echo t>delme;echo t2>>delme;cat delme;mv delme d;mv d
delme;rm delme
step #4: $ service auditd stop
step #5: $ ausearch -f delme
There are syscalls from /usr/bin/cat, /usr/bin/mv, /usr/bin/rm but there
are no any syscalls (openat expected)
for /usr/bin/bash (current shell process) for the file.
If step #3 is performed from another tty, then openat syscalls
(CREATE for the first echo and NORMAL for the second one)
is logged for the /usr/bin/bash process.
`uname -a` returns: Linux grin-vb-ubuntu-22-0-4 5.19.0-41-generic
#42~22.04.01-Ubuntu SMP PREEMPT_DYNAMIC Tue Apr 18 17:40:00 UTC 2 x86_64
x86_64 x86_64 GNU/Linux
Should I open an issue for the case at
https://github.com/linux-audit/audit-kernel ?
Best regards
Rinat
PS.
At first I had the same problem with my service that listens to
audit-netlink.
Then I just checked out the same scenario for auditid.
^ permalink raw reply [flat|nested] 8+ messages in thread
* Auditd doesn't receive syscalls after installation for the current shell.
@ 2023-05-24 11:37 ` Rinat Gadelshin
0 siblings, 0 replies; 8+ messages in thread
From: Rinat Gadelshin @ 2023-05-24 11:37 UTC (permalink / raw)
To: linux-audit; +Cc: audit
Hello there.
It seems that the kernel doesn't send messages for syscalls of the shell
process from which auditd is installed.
Reproducing steps (performed on Ubuntu 22.04 x86_64 on virtual box by
`root`):
step #1: $ apt install auditd
step #2: $ auditctl -a always,exit -F arch=b64 -S openat,renameat2,unlinkat
step #3: $ echo t>delme;echo t2>>delme;cat delme;mv delme d;mv d
delme;rm delme
step #4: $ service auditd stop
step #5: $ ausearch -f delme
There are syscalls from /usr/bin/cat, /usr/bin/mv, /usr/bin/rm but there
are no any syscalls (openat expected)
for /usr/bin/bash (current shell process) for the file.
If step #3 is performed from another tty, then openat syscalls
(CREATE for the first echo and NORMAL for the second one)
is logged for the /usr/bin/bash process.
`uname -a` returns: Linux grin-vb-ubuntu-22-0-4 5.19.0-41-generic
#42~22.04.01-Ubuntu SMP PREEMPT_DYNAMIC Tue Apr 18 17:40:00 UTC 2 x86_64
x86_64 x86_64 GNU/Linux
Should I open an issue for the case at
https://github.com/linux-audit/audit-kernel ?
Best regards
Rinat
PS.
At first I had the same problem with my service that listens to
audit-netlink.
Then I just checked out the same scenario for auditid.
--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: Auditd doesn't receive syscalls after installation for the current shell.
2023-05-24 11:37 ` Rinat Gadelshin
@ 2023-05-24 14:45 ` Steve Grubb
-1 siblings, 0 replies; 8+ messages in thread
From: Steve Grubb @ 2023-05-24 14:45 UTC (permalink / raw)
To: linux-audit; +Cc: audit, Rinat Gadelshin
On Wednesday, May 24, 2023 7:37:27 AM EDT Rinat Gadelshin wrote:
> Hello there.
>
> It seems that the kernel doesn't send messages for syscalls of the shell
> process from which auditd is installed.
>
> Reproducing steps (performed on Ubuntu 22.04 x86_64 on virtual box by
> `root`):
>
> step #1: $ apt install auditd
> step #2: $ auditctl -a always,exit -F arch=b64 -S openat,renameat2,unlinkat
> step #3: $ echo t>delme;echo t2>>delme;cat delme;mv delme d;mv d
> delme;rm delme
> step #4: $ service auditd stop
> step #5: $ ausearch -f delme
>
> There are syscalls from /usr/bin/cat, /usr/bin/mv, /usr/bin/rm but there
> are no any syscalls (openat expected)
> for /usr/bin/bash (current shell process) for the file.
>
> If step #3 is performed from another tty, then openat syscalls
> (CREATE for the first echo and NORMAL for the second one)
> is logged for the /usr/bin/bash process.
>
> `uname -a` returns: Linux grin-vb-ubuntu-22-0-4 5.19.0-41-generic
> #42~22.04.01-Ubuntu SMP PREEMPT_DYNAMIC Tue Apr 18 17:40:00 UTC 2 x86_64
> x86_64 x86_64 GNU/Linux
>
> Should I open an issue for the case at
> https://github.com/linux-audit/audit-kernel ?
Are you booting with audit=1 ? If not, the install process and any before it
are not auditable. You will only get events for processes started after audit
enabled = 1.
-Steve
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: Auditd doesn't receive syscalls after installation for the current shell.
@ 2023-05-24 14:45 ` Steve Grubb
0 siblings, 0 replies; 8+ messages in thread
From: Steve Grubb @ 2023-05-24 14:45 UTC (permalink / raw)
To: linux-audit; +Cc: audit, Rinat Gadelshin
On Wednesday, May 24, 2023 7:37:27 AM EDT Rinat Gadelshin wrote:
> Hello there.
>
> It seems that the kernel doesn't send messages for syscalls of the shell
> process from which auditd is installed.
>
> Reproducing steps (performed on Ubuntu 22.04 x86_64 on virtual box by
> `root`):
>
> step #1: $ apt install auditd
> step #2: $ auditctl -a always,exit -F arch=b64 -S openat,renameat2,unlinkat
> step #3: $ echo t>delme;echo t2>>delme;cat delme;mv delme d;mv d
> delme;rm delme
> step #4: $ service auditd stop
> step #5: $ ausearch -f delme
>
> There are syscalls from /usr/bin/cat, /usr/bin/mv, /usr/bin/rm but there
> are no any syscalls (openat expected)
> for /usr/bin/bash (current shell process) for the file.
>
> If step #3 is performed from another tty, then openat syscalls
> (CREATE for the first echo and NORMAL for the second one)
> is logged for the /usr/bin/bash process.
>
> `uname -a` returns: Linux grin-vb-ubuntu-22-0-4 5.19.0-41-generic
> #42~22.04.01-Ubuntu SMP PREEMPT_DYNAMIC Tue Apr 18 17:40:00 UTC 2 x86_64
> x86_64 x86_64 GNU/Linux
>
> Should I open an issue for the case at
> https://github.com/linux-audit/audit-kernel ?
Are you booting with audit=1 ? If not, the install process and any before it
are not auditable. You will only get events for processes started after audit
enabled = 1.
-Steve
--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: Auditd doesn't receive syscalls after installation for the current shell.
2023-05-24 14:45 ` Steve Grubb
@ 2023-05-24 14:53 ` Paul Moore
-1 siblings, 0 replies; 8+ messages in thread
From: Paul Moore @ 2023-05-24 14:53 UTC (permalink / raw)
To: Steve Grubb; +Cc: linux-audit, audit, Rinat Gadelshin
On Wed, May 24, 2023 at 10:46 AM Steve Grubb <sgrubb@redhat.com> wrote:
> On Wednesday, May 24, 2023 7:37:27 AM EDT Rinat Gadelshin wrote:
> > Hello there.
> >
> > It seems that the kernel doesn't send messages for syscalls of the shell
> > process from which auditd is installed.
> >
> > Reproducing steps (performed on Ubuntu 22.04 x86_64 on virtual box by
> > `root`):
> >
> > step #1: $ apt install auditd
> > step #2: $ auditctl -a always,exit -F arch=b64 -S openat,renameat2,unlinkat
> > step #3: $ echo t>delme;echo t2>>delme;cat delme;mv delme d;mv d
> > delme;rm delme
> > step #4: $ service auditd stop
> > step #5: $ ausearch -f delme
> >
> > There are syscalls from /usr/bin/cat, /usr/bin/mv, /usr/bin/rm but there
> > are no any syscalls (openat expected)
> > for /usr/bin/bash (current shell process) for the file.
> >
> > If step #3 is performed from another tty, then openat syscalls
> > (CREATE for the first echo and NORMAL for the second one)
> > is logged for the /usr/bin/bash process.
> >
> > `uname -a` returns: Linux grin-vb-ubuntu-22-0-4 5.19.0-41-generic
> > #42~22.04.01-Ubuntu SMP PREEMPT_DYNAMIC Tue Apr 18 17:40:00 UTC 2 x86_64
> > x86_64 x86_64 GNU/Linux
> >
> > Should I open an issue for the case at
> > https://github.com/linux-audit/audit-kernel ?
>
> Are you booting with audit=1 ? If not, the install process and any before it
> are not auditable. You will only get events for processes started after audit
> enabled = 1.
It is also worth noting that some distributions (I'm not sure if this
applies to Ubuntu) effectively limit auditing with their default
runtime configuration, see the wiki page below for more information:
* https://github.com/linux-audit/audit-documentation/wiki/HOWTO-Fedora-Enable-Auditing
--
paul-moore.com
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: Auditd doesn't receive syscalls after installation for the current shell.
@ 2023-05-24 14:53 ` Paul Moore
0 siblings, 0 replies; 8+ messages in thread
From: Paul Moore @ 2023-05-24 14:53 UTC (permalink / raw)
To: Steve Grubb; +Cc: audit, linux-audit, Rinat Gadelshin
On Wed, May 24, 2023 at 10:46 AM Steve Grubb <sgrubb@redhat.com> wrote:
> On Wednesday, May 24, 2023 7:37:27 AM EDT Rinat Gadelshin wrote:
> > Hello there.
> >
> > It seems that the kernel doesn't send messages for syscalls of the shell
> > process from which auditd is installed.
> >
> > Reproducing steps (performed on Ubuntu 22.04 x86_64 on virtual box by
> > `root`):
> >
> > step #1: $ apt install auditd
> > step #2: $ auditctl -a always,exit -F arch=b64 -S openat,renameat2,unlinkat
> > step #3: $ echo t>delme;echo t2>>delme;cat delme;mv delme d;mv d
> > delme;rm delme
> > step #4: $ service auditd stop
> > step #5: $ ausearch -f delme
> >
> > There are syscalls from /usr/bin/cat, /usr/bin/mv, /usr/bin/rm but there
> > are no any syscalls (openat expected)
> > for /usr/bin/bash (current shell process) for the file.
> >
> > If step #3 is performed from another tty, then openat syscalls
> > (CREATE for the first echo and NORMAL for the second one)
> > is logged for the /usr/bin/bash process.
> >
> > `uname -a` returns: Linux grin-vb-ubuntu-22-0-4 5.19.0-41-generic
> > #42~22.04.01-Ubuntu SMP PREEMPT_DYNAMIC Tue Apr 18 17:40:00 UTC 2 x86_64
> > x86_64 x86_64 GNU/Linux
> >
> > Should I open an issue for the case at
> > https://github.com/linux-audit/audit-kernel ?
>
> Are you booting with audit=1 ? If not, the install process and any before it
> are not auditable. You will only get events for processes started after audit
> enabled = 1.
It is also worth noting that some distributions (I'm not sure if this
applies to Ubuntu) effectively limit auditing with their default
runtime configuration, see the wiki page below for more information:
* https://github.com/linux-audit/audit-documentation/wiki/HOWTO-Fedora-Enable-Auditing
--
paul-moore.com
--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: Auditd doesn't receive syscalls after installation for the current shell.
2023-05-24 14:53 ` Paul Moore
@ 2023-05-24 19:12 ` Rinat Gadelshin
-1 siblings, 0 replies; 8+ messages in thread
From: Rinat Gadelshin @ 2023-05-24 19:12 UTC (permalink / raw)
To: Paul Moore, Steve Grubb; +Cc: linux-audit, audit
On 24.05.2023 17:53, Paul Moore wrote:
> On Wed, May 24, 2023 at 10:46 AM Steve Grubb <sgrubb@redhat.com> wrote:
>> On Wednesday, May 24, 2023 7:37:27 AM EDT Rinat Gadelshin wrote:
>>> Hello there.
>>>
>>> It seems that the kernel doesn't send messages for syscalls of the shell
>>> process from which auditd is installed.
>>>
>>> Reproducing steps (performed on Ubuntu 22.04 x86_64 on virtual box by
>>> `root`):
>>>
>>> step #1: $ apt install auditd
>>> step #2: $ auditctl -a always,exit -F arch=b64 -S openat,renameat2,unlinkat
>>> step #3: $ echo t>delme;echo t2>>delme;cat delme;mv delme d;mv d
>>> delme;rm delme
>>> step #4: $ service auditd stop
>>> step #5: $ ausearch -f delme
>>>
>>> There are syscalls from /usr/bin/cat, /usr/bin/mv, /usr/bin/rm but there
>>> are no any syscalls (openat expected)
>>> for /usr/bin/bash (current shell process) for the file.
>>>
>>> If step #3 is performed from another tty, then openat syscalls
>>> (CREATE for the first echo and NORMAL for the second one)
>>> is logged for the /usr/bin/bash process.
>>>
>>> `uname -a` returns: Linux grin-vb-ubuntu-22-0-4 5.19.0-41-generic
>>> #42~22.04.01-Ubuntu SMP PREEMPT_DYNAMIC Tue Apr 18 17:40:00 UTC 2 x86_64
>>> x86_64 x86_64 GNU/Linux
>>>
>>> Should I open an issue for the case at
>>> https://github.com/linux-audit/audit-kernel ?
>> Are you booting with audit=1 ? If not, the install process and any before it
>> are not auditable. You will only get events for processes started after audit
>> enabled = 1.
> It is also worth noting that some distributions (I'm not sure if this
> applies to Ubuntu) effectively limit auditing with their default
> runtime configuration, see the wiki page below for more information:
>
> * https://github.com/linux-audit/audit-documentation/wiki/HOWTO-Fedora-Enable-Auditing
>
Steve, Paul, thank you!
It make the situation completely clear to me =)
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: Auditd doesn't receive syscalls after installation for the current shell.
@ 2023-05-24 19:12 ` Rinat Gadelshin
0 siblings, 0 replies; 8+ messages in thread
From: Rinat Gadelshin @ 2023-05-24 19:12 UTC (permalink / raw)
To: Paul Moore, Steve Grubb; +Cc: audit, linux-audit
On 24.05.2023 17:53, Paul Moore wrote:
> On Wed, May 24, 2023 at 10:46 AM Steve Grubb <sgrubb@redhat.com> wrote:
>> On Wednesday, May 24, 2023 7:37:27 AM EDT Rinat Gadelshin wrote:
>>> Hello there.
>>>
>>> It seems that the kernel doesn't send messages for syscalls of the shell
>>> process from which auditd is installed.
>>>
>>> Reproducing steps (performed on Ubuntu 22.04 x86_64 on virtual box by
>>> `root`):
>>>
>>> step #1: $ apt install auditd
>>> step #2: $ auditctl -a always,exit -F arch=b64 -S openat,renameat2,unlinkat
>>> step #3: $ echo t>delme;echo t2>>delme;cat delme;mv delme d;mv d
>>> delme;rm delme
>>> step #4: $ service auditd stop
>>> step #5: $ ausearch -f delme
>>>
>>> There are syscalls from /usr/bin/cat, /usr/bin/mv, /usr/bin/rm but there
>>> are no any syscalls (openat expected)
>>> for /usr/bin/bash (current shell process) for the file.
>>>
>>> If step #3 is performed from another tty, then openat syscalls
>>> (CREATE for the first echo and NORMAL for the second one)
>>> is logged for the /usr/bin/bash process.
>>>
>>> `uname -a` returns: Linux grin-vb-ubuntu-22-0-4 5.19.0-41-generic
>>> #42~22.04.01-Ubuntu SMP PREEMPT_DYNAMIC Tue Apr 18 17:40:00 UTC 2 x86_64
>>> x86_64 x86_64 GNU/Linux
>>>
>>> Should I open an issue for the case at
>>> https://github.com/linux-audit/audit-kernel ?
>> Are you booting with audit=1 ? If not, the install process and any before it
>> are not auditable. You will only get events for processes started after audit
>> enabled = 1.
> It is also worth noting that some distributions (I'm not sure if this
> applies to Ubuntu) effectively limit auditing with their default
> runtime configuration, see the wiki page below for more information:
>
> * https://github.com/linux-audit/audit-documentation/wiki/HOWTO-Fedora-Enable-Auditing
>
Steve, Paul, thank you!
It make the situation completely clear to me =)
--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit
^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2023-05-24 19:12 UTC | newest]
Thread overview: 8+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-05-24 11:37 Auditd doesn't receive syscalls after installation for the current shell Rinat Gadelshin
2023-05-24 11:37 ` Rinat Gadelshin
2023-05-24 14:45 ` Steve Grubb
2023-05-24 14:45 ` Steve Grubb
2023-05-24 14:53 ` Paul Moore
2023-05-24 14:53 ` Paul Moore
2023-05-24 19:12 ` Rinat Gadelshin
2023-05-24 19:12 ` Rinat Gadelshin
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.