From mboxrd@z Thu Jan 1 00:00:00 1970 From: Matthew Booth Subject: init and its direct children not audited? Date: Wed, 15 Aug 2007 15:51:21 +0100 Message-ID: <1187189481.7705.19.camel@localhost.localdomain> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============0409639067==" Return-path: Received: from [192.168.1.4] (sebastian-int.corp.redhat.com [172.16.52.221]) by pobox.fab.redhat.com (8.13.1/8.13.1) with ESMTP id l7FKjwT2004383 for ; Wed, 15 Aug 2007 16:46:00 -0400 List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit List-Id: linux-audit@redhat.com --===============0409639067== Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="=-Yy2HzN4WWk2cqyOaGbqU" --=-Yy2HzN4WWk2cqyOaGbqU Content-Type: text/plain Content-Transfer-Encoding: quoted-printable I have the following in my test audit configuration on RHEL4 U5: -a entry,always -S exit -S exit_group -S execve -S fork -S vfork -S clone My first observation is that I've never seen an audit record with pid=3D1. It's fairly easy to reproduce this one. Log in at the console, then log out. You'll see a process execve() a new mingetty, but you won't see the fork, vfork or clone which created it. My second observation is a bit more complex. I have a box running Oracle RAC. RAC runs some particularly nasty scripts on a regular basis (once per second). In outline, it does this: In inittab: respawn:init.cssd In init.cssd: while true; do init.cssd runcheck done I see that a process execs 'init.cssd runcheck' once per second. However, I do not see a process fork, vfork or clone that process. This suggests that audit data isn't being produced for the top level init.cssd job. Does this ring any bells? Is there some other method of process creation I'm not aware of? Is init intentionally not audited, and if so, how do I audit it? Thanks, Matt --=20 Matthew Booth, RHCA, RHCSS Red Hat, Global Professional Services M: +44 (0)7977 267231 GPG ID: D33C3490 GPG FPR: 3733 612D 2D05 5458 8A8A 1600 3441 EA19 D33C 3490 --=-Yy2HzN4WWk2cqyOaGbqU Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iD8DBQBGwxLpNEHqGdM8NJARAk0JAJsEYL4Bh4qzmxUMB8sdNyfKaJg3JgCeOU4k luLFsAAUglJ5Ckt+U2HU7w4= =0oMP -----END PGP SIGNATURE----- --=-Yy2HzN4WWk2cqyOaGbqU-- --===============0409639067== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============0409639067==--