From mboxrd@z Thu Jan 1 00:00:00 1970 From: Matthew Booth Subject: Auditing detach in Laus Date: Thu, 01 Mar 2007 13:19:00 +0000 Message-ID: <1172755140.3807.17.camel@localhost.localdomain> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============0308586156==" Return-path: Received: from [10.235.56.120] (sebastian-int.corp.redhat.com [172.16.52.221]) by pobox.surrey.redhat.com (8.12.11.20060308/8.12.11) with ESMTP id l21LwQKQ024420 for ; Thu, 1 Mar 2007 21:58:33 GMT List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit List-Id: linux-audit@redhat.com --===============0308586156== Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="=-jCa3PNJZvHdLoanOgUzo" --=-jCa3PNJZvHdLoanOgUzo Content-Type: text/plain Content-Transfer-Encoding: quoted-printable I realise that Laus is not the primary focus of this list, but I'm hoping there might be some experience here. I'd like to audit a Laus detach, which as I understand it is implemented as an ioctl (AUIOCDETACH) on /dev/audit. For debugging purposes, I've stripped my rule back to the following: tag "AUDIT_ioctl" syscall ioctl =3D is-auditdevice(arg0); I get nothing on detach, although I get plenty of other hits on this rule. My best guess is that it doesn't evaluate these rules until call completion, by which time the process is already detached. Is this right? If so, this would be a fairly severe architectural flaw. Either way, I'd like to be able to make an informed recommendation to my customer. Thanks, Matt --=20 Red Hat, Global Professional Services M: +44 (0)7977 267231 GPG ID: D33C3490 GPG FPR: 3733 612D 2D05 5458 8A8A 1600 3441 EA19 D33C 3490 --=-jCa3PNJZvHdLoanOgUzo Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iD8DBQBF5tLENEHqGdM8NJARAtz4AJ9I/NPdv++ZxWnIeeRM/iaZmorjtACfeYnc HEenHY4ueQnAw1qQC1SBL3A= =3KdG -----END PGP SIGNATURE----- --=-jCa3PNJZvHdLoanOgUzo-- --===============0308586156== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============0308586156==--