Re: OBJ_PID records

[Eric Paris <eparis@redhat.com>]

Started playing with this today, with no audit rules i was unable to
trigger the OBJ_PID issue.  With a single syscall audit rule 

-a entry,always -S adjtimex -S settimeofday -k time-change

i was unable to trigger the problem (might have just not left it long
enough, going back and trying again).  With a single file watch I was
able to trigger the problem.

[root@dhcp59-192 audit]# auditctl -l
LIST_RULES: exit,always watch=/etc/localtime perm=wa key=time-change
[root@dhcp59-192 audit]# for i in `seq 1 500`; do load_policy; done &
[1] 17639
[root@dhcp59-192 audit]# for i in `seq 1 50`; do sleep 5; ausearch -m OBJ_PID; done &
[2] 17644
[root@dhcp59-192 audit]# <no matches>
<no matches>
<no matches>
<no matches>
<no matches>
<no matches>
<no matches>
<no matches>
----
time->Fri Sep 28 06:02:50 2007
type=OBJ_PID msg=audit(1190973770.581:4409): opid=1956  obj=system_u:system_r:syslogd_t:s0
type=SYSCALL msg=audit(1190973770.581:4409): arch=c000003e syscall=1 success=yes exit=3893128 a0=4 a1=2ae984eee000 a2=3b6788 a3=0 items=0 ppid=17639 pid=17686 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 comm="load_policy" exe="/usr/sbin/load_policy" subj=root:system_r:unconfined_t:s0-s0:c0.c1023 key=(null)
type=MAC_POLICY_LOAD msg=audit(1190973770.581:4409): policy loaded auid=4294967295

Interestingly on this machine the opid has ALWAYS been 1956 with
obj=syslogd_t.  I don't however think there is anything special about
syslog though as that wasn't the obj in the messages sgrubb was getting,
although i do wonder if it was the same opid every time.....

-Eric


On Fri, 2007-09-21 at 15:06 -0400, Steve Grubb wrote:
> Hi,
> 
> I was noticing that I'm seeing OBJ_PID records sometimes when there is 
> MAC_POLICY_LOAD event. I didn't think these two would go together. I'm seeing 
> this:
> 
> type=OBJ_PID msg=audit(09/18/2007 06:26:21.236:216) : opid=3211  
> obj=user_u:system_r:unconfined_t:s0 
> type=SYSCALL msg=audit(09/18/2007 06:26:21.236:216) : arch=x86_64 
> syscall=write success=yes exit=1592854 a0=4 a1=2aaaaaae2000 a2=184e16 a3=0 
> items=0 ppid=3333 pid=3334 auid=sgrubb uid=root gid=root euid=root suid=root 
> fsuid=root egid=root sgid=root fsgid=root tty=pts0 comm=load_policy 
> exe=/usr/sbin/load_policy subj=user_u:system_r:load_policy_t:s0 key=(null) 
> type=MAC_POLICY_LOAD msg=audit(09/18/2007 06:26:21.236:216) : policy loaded 
> auid=sgrubb 
> 
> Shouldn't these only come out when kill (or its friends) is in effect? The 
> above syscall was a write. I don't think the current syscall is being taken 
> into account in audit_match_signal.
> 
> -Steve
> 
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit