From mboxrd@z Thu Jan 1 00:00:00 1970 From: Eric Paris Subject: Re: OBJ_PID records Date: Thu, 27 Sep 2007 14:40:45 -0400 Message-ID: <1190918445.3591.29.camel@localhost.localdomain> References: <200709211506.56322.sgrubb@redhat.com> Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <200709211506.56322.sgrubb@redhat.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: aviro@redhat.com Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com Started playing with this today, with no audit rules i was unable to trigger the OBJ_PID issue. With a single syscall audit rule -a entry,always -S adjtimex -S settimeofday -k time-change i was unable to trigger the problem (might have just not left it long enough, going back and trying again). With a single file watch I was able to trigger the problem. [root@dhcp59-192 audit]# auditctl -l LIST_RULES: exit,always watch=/etc/localtime perm=wa key=time-change [root@dhcp59-192 audit]# for i in `seq 1 500`; do load_policy; done & [1] 17639 [root@dhcp59-192 audit]# for i in `seq 1 50`; do sleep 5; ausearch -m OBJ_PID; done & [2] 17644 [root@dhcp59-192 audit]# ---- time->Fri Sep 28 06:02:50 2007 type=OBJ_PID msg=audit(1190973770.581:4409): opid=1956 obj=system_u:system_r:syslogd_t:s0 type=SYSCALL msg=audit(1190973770.581:4409): arch=c000003e syscall=1 success=yes exit=3893128 a0=4 a1=2ae984eee000 a2=3b6788 a3=0 items=0 ppid=17639 pid=17686 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 comm="load_policy" exe="/usr/sbin/load_policy" subj=root:system_r:unconfined_t:s0-s0:c0.c1023 key=(null) type=MAC_POLICY_LOAD msg=audit(1190973770.581:4409): policy loaded auid=4294967295 Interestingly on this machine the opid has ALWAYS been 1956 with obj=syslogd_t. I don't however think there is anything special about syslog though as that wasn't the obj in the messages sgrubb was getting, although i do wonder if it was the same opid every time..... -Eric On Fri, 2007-09-21 at 15:06 -0400, Steve Grubb wrote: > Hi, > > I was noticing that I'm seeing OBJ_PID records sometimes when there is > MAC_POLICY_LOAD event. I didn't think these two would go together. I'm seeing > this: > > type=OBJ_PID msg=audit(09/18/2007 06:26:21.236:216) : opid=3211 > obj=user_u:system_r:unconfined_t:s0 > type=SYSCALL msg=audit(09/18/2007 06:26:21.236:216) : arch=x86_64 > syscall=write success=yes exit=1592854 a0=4 a1=2aaaaaae2000 a2=184e16 a3=0 > items=0 ppid=3333 pid=3334 auid=sgrubb uid=root gid=root euid=root suid=root > fsuid=root egid=root sgid=root fsgid=root tty=pts0 comm=load_policy > exe=/usr/sbin/load_policy subj=user_u:system_r:load_policy_t:s0 key=(null) > type=MAC_POLICY_LOAD msg=audit(09/18/2007 06:26:21.236:216) : policy loaded > auid=sgrubb > > Shouldn't these only come out when kill (or its friends) is in effect? The > above syscall was a write. I don't think the current syscall is being taken > into account in audit_match_signal. > > -Steve > > -- > Linux-audit mailing list > Linux-audit@redhat.com > https://www.redhat.com/mailman/listinfo/linux-audit