Re: audit 1.2.2 released

[Michael C Thompson <thompsmc@us.ibm.com>]

Michael C Thompson wrote:
> Steve Grubb wrote:
>> On Monday 15 May 2006 15:57, Michael C Thompson wrote:
>>> auditctl is still reporting the "error sending rule" problem. Here are
>>> my auditctl and kernel versions:
>>>
>>> auditctl version 1.2.2
>>> 2.6.16-1.2200.2.2_FC6.lspp.25
>>>
>>> # auditctl -l
>>> Error sending rule list request (Operation not permitted)
>>
>> This is not the error sending rule problem. This looks like a 
>> permission problem. What selinux policy and role are you doing this 
>> from? Are there any  relevant AVCs in the audit logs from this time?
>>
>> -Steve
> 

I've "enchanced" this transcript with strace output (selective) and the 
return code of the selinux_socket_recvmsg call.

> This is a transcript from Permissive mode, with role being staff_r. I do 
> not see the "Error sending rule list request (Operation not permitted)" 
> when SELinux is disabled (selinux=0) or when as auditadm_r at SystemHigh.
> 
> # auditctl -l

sendto(3, "\20\0\0\0\365\3\5\0\1\0\0\0\0\0\0\0", 16, 0, 
{sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 16
poll([{fd=3, events=POLLIN, revents=POLLIN}], 1, 100) = 1
recvfrom(3, "$\0\0\0\2\0\0\0\1\0\0\0\322\7\0\0\377\377\377\377\20\0"..., 
8476, MSG_PEEK|MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, 
groups=00000000}, [12]) = 36
-> selinux_sock_recvmsg returns 0

recvfrom(3, "$\0\0\0\2\0\0\0\1\0\0\0\322\7\0\0\377\377\377\377\20\0"..., 
8476, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 
[12]) = 36
-> selinux_sock_recvmsg returns 0

write(2, "Error sending rule list request "..., 57Error sending rule 
list request (Operation not permitted)) = 57
> Error sending rule list request (Operation not permitted)
> [ resulting log activity:
> type=AVC msg=audit(1147657744.953:39): avc:  denied  { nlmsg_readpriv } 
> for  pid=2091 comm="auditctl" 
> scontext=root:staff_r:staff_t:s0-s15:c0.c255 
> tcontext=root:staff_r:staff_t:s0-s15:c0.c255 tclass=netlink_audit_socket
> type=SYSCALL msg=audit(1147657744.953:39): arch=40000003 syscall=102 
> success=yes exit=16 a0=b a1=bfad2760 a2=805b0f8 a3=10 items=0 ppid=2067 
> pid=2091 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 
> tty=pts1 comm="auditctl" exe="/sbin/auditctl" 
> subj=root:staff_r:staff_t:s0-s15:c0.c255
> type=SOCKADDR msg=audit(1147657744.953:39): saddr=100000000000000000000000
> type=SOCKETCALL msg=audit(1147657744.953:39): nargs=6 a0=3 a1=bfad69fc 
> a2=10 a3=0 a4=bfad2790 a5=c
> ]
> 
> # auditctl -l
sendto(3, "\20\0\0\0\365\3\5\0\1\0\0\0\0\0\0\0", 16, 0, 
{sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 16
poll([{fd=3, events=POLLIN, revents=POLLIN}], 1, 100) = 1

recvfrom(3, "$\0\0\0\2\0\0\0\1\0\0\0\326\7\0\0\0\0\0\0\20\0\0\0\365"..., 
8476, MSG_PEEK|MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, 
groups=00000000}, [12]) = 36
-> selinux_sock_recvmsg returns 0

recvfrom(3, "$\0\0\0\2\0\0\0\1\0\0\0\326\7\0\0\0\0\0\0\20\0\0\0\365"..., 
8476, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 
[12]) = 36
-> selinux_sock_recvmsg returns 0

select(4, [3], NULL, NULL, {0, 100000}) = 1 (in [3], left {0, 100000})
recvfrom(3, "\20\0\0\0\3\0\2\0\1\0\0\0\326\7\0\0", 8476, MSG_DONTWAIT, 
{sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 16
-> selinux_sock_recvmsg returns 0

> No rules
> [ no log activity ]

I do not know enough of about the auditctl code, but to me this looks 
like auditctl is failing to issue the 3rd recvfrom syscall.


As a side note, auditctl is somehow executable by staff_t, but staff_t 
can send to the netlink socket (although staff_t can estabish one).

Thanks,
Mike