Re: [PATCH] Fix acct quoting in audit_log_acct_message())

[Tomas Mraz <tmraz@redhat.com>]

On Tue, 2008-03-04 at 10:07 -0500, John Dennis wrote:
> Miloslav Trmac wrote:
> > Hello,
> > audit_log_acct_message() is currently quoting acct differently from all 
> > other users: it adds quotes to acct if it is represented in hexadecimal, 
> > not when it is represented as-is.
> 
> This isn't the only audit hexadecimal parsing issue, there are many 
> more, see my previous posts. It is a sad fact audit output is impossible 
> to parse correctly given only the output. Correct parsing of audit data 
> demands private knowledge about the format of audit log messages on a 
> per kernel version basis, this is very broken IMHO.

Following up on the discussion we had on IRC about making the audit
messages easily parsable.

This proposal is just for starting the discussion.

1. Messages contain <name>=<value> pairs separated by spaces.
2. All <names> are just alphanumeric sequences.
3. Values can be either:
 a) byte sequences with the following special characters encoded as %XX
where XX is hexadecimal value of the encoded byte. Special characters
are: bytes with value <= 0x20 or >= 0x7F, '%', '(', ')', and '='.
 b) recursively embedded messages enclosed in '(' and ')' parentheses.


type=USER_START msg=audit(1204632061.112:32361): user pid=10902 uid=0
auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023
msg='op=PAM:session_open acct=root exe="/usr/sbin/crond" (hostname=?,
addr=?, terminal=cron res=success)'

becomes:

type=USER_START msg=(audit=1204632061.112:3236 src=user pid=10902 uid=0
auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023
msg=(op=PAM:session_open acct=root exe=/usr/sbin/crond hostname=? addr=?
terminal=cron res=success))

type=AVC msg=audit(1204601533.621:32307): avc:  denied  { read write }
for  pid=9822 comm="tmpwatch" path="socket:[14038]" dev=sockfs ino=14038
scontext=system_u:system_r:tmpreaper_t:s0-s0:c0.c1023
tcontext=system_u:system_r:crond_t:s0-s0:c0.c1023 tclass=tcp_socket

becomes:

type=AVC msg=(audit=1204601533.621:32307 src=avc kind=denied
acts=read:write pid=9822 comm=tmpwatch path=socket:[14038] dev=sockfs
ino=14038 scontext=system_u:system_r:tmpreaper_t:s0-s0:c0.c1023
tcontext=system_u:system_r:crond_t:s0-s0:c0.c1023 tclass=tcp_socket)

type=SYSCALL msg=audit(1204601533.621:32307): arch=c000003e syscall=59
success=yes exit=0 a0=2496490 a1=2493360 a2=24959a0 a3=8 items=0
ppid=9788 pid=9822 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=(none) ses=48 comm="tmpwatch"
exe="/usr/sbin/tmpwatch"
subj=system_u:system_r:tmpreaper_t:s0-s0:c0.c1023 key=(null)

becomes

type=SYSCALL msg=(audit=1204601533.621:32307 arch=c000003e syscall=59
success=yes exit=0 a0=2496490 a1=2493360 a2=24959a0 a3=8 items=0
ppid=9788 pid=9822 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=%28none%29 ses=48 comm=tmpwatch
exe=/usr/sbin/tmpwatch subj=system_u:system_r:tmpreaper_t:s0-s0:c0.c1023
key=%28null%29)

-- 
Tomas Mraz
No matter how far down the wrong road you've gone, turn back.
                                              Turkish proverb