Re: aulast only displaying reboot pseudo-users

Steve Grubb
2014-06-17T15:04:01Z

On Tuesday, June 17, 2014 10:55:42 AM Richard Guy Briggs wrote:
> > This feel like 2 clear bugs.
> >
> > 1) The kernel records for LOGIN are 'malformed' in 3.14.
>
> Yes. That's why it got fixed for 3.15.
>
> 5ee9a75 audit: fix dangling keywords in audit_log_set_loginuid() output
> introduced it between 3.13 and 3.14-rc1
>
> aa589a1 audit: remove superfluous new- prefix in AUDIT_LOGIN messages
> fixed it between 3.14 and 3.15-rc1
>
> So it is fine in 3.15.

We need this fixed in current kernels. Its a low risk patch that fixes this
problem for a lot of people.

> > 2) Userspace silently throws records which are 'malformed' away, instead
> > of just printing them...
>
> So according to Linus, we (I) violated the "thou shalt not break
> userspace" golden rule with the second patch.
>
> But it was already broken according to Steve which is why the first
> patch was submitted.
>
> > ausearch -m LOGIN should be able to display these things...
>
> Agreed.
>
> One lesson here? Let's get a minimum useful subset of
> http://people.redhat.com/sgrubb/audit/audit-parse.txt into
> linux-2.6/Documentation/ tree to try to avoid this issue in the future.

I'd like to reformat that before putting it in the linux kernel. It needs to
be written from a generic howto perspective and not a library design
perspective. Although that document is what has guided audit event design for
about 8 or 9 years.

-Steve