audit rule question

audit rule question

[LC Bruzenak]

Q: Manpage says :
 
"-S [Syscall name or number|all]"
..."You may also specify multiple syscalls in the same rule as a comma
separated list with no spaces in between. Doing so improves performance
since  fewer rules need to be evaluated."...

So I'd have thought that this would work:
-a always,exit -F arch=b64 -S adjtimex,settimeofday -k time-change

but only this does:
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -k time-change

Restarting auditd says:
There was an error in line 165 of /etc/audit/audit.rules

Am I misunderstanding this option, or is there a manpage or code error?
audit-1.7.2-6.fc9.x86_64

Thx,
LCB.

-- 
LC (Lenny) Bruzenak
lenny@magitekltd.com

Re: audit rule question

[Steve Grubb]

On Wednesday 07 May 2008 12:16:01 LC Bruzenak wrote:
> Am I misunderstanding this option, or is there a manpage or code error?
> audit-1.7.2-6.fc9.x86_64

I'd say we need to fix the man page.

-Steve

Re: audit rule question

[LC Bruzenak]

On Wed, 2008-05-07 at 12:44 -0400, Steve Grubb wrote:
> On Wednesday 07 May 2008 12:16:01 LC Bruzenak wrote:
> > Am I misunderstanding this option, or is there a manpage or code error?
> > audit-1.7.2-6.fc9.x86_64
> 
> I'd say we need to fix the man page.

OK. Should I open a bz?

And also along these lines, manpage says:
-a list,action

but the supplied /usr/share/doc/audit-1.7.2/stig.rules file has, in a
few places:
stig.rules:-a always,exit

which I believe is backwards.

The other supplied example rules (capp, lspp, nispom) appear to be in
the correct order.

I am a little surprised that the "-a always,exit" doesn't cause an
error. I wonder if it works correctly - maybe auditctl code is smart
enough to overcome syntactic dyslexia? :)

LCB.

-- 
LC (Lenny) Bruzenak
lenny@magitekltd.com

Re: audit rule question

[LC Bruzenak]

> I am a little surprised that the "-a always,exit" doesn't cause an
> error. I wonder if it works correctly - maybe auditctl code is smart
> enough to overcome syntactic dyslexia? :)
> 
given rules:
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -k time-change
-a exit,always -F arch=b64 -S adjtimex -S settimeofday -k time-change

[root@hugo ~]# auditctl -l | grep timex
LIST_RULES: exit,always arch=1073741827 (0x40000003) key=time-change
syscall=settimeofday,adjtimex
LIST_RULES: exit,always arch=3221225534 (0xc000003e) key=time-change
syscall=adjtimex,settimeofday

So it seems the auditctl code is able to get the intent right regardless
of the order.

LCB.

-- 
LC (Lenny) Bruzenak
lenny@magitekltd.com

Re: audit rule question

[Steve Grubb]

On Wednesday 07 May 2008 12:56:37 LC Bruzenak wrote:
> > I'd say we need to fix the man page.
>
> OK. Should I open a bz?

I put it in the TODO list for 1.7.3. So, it is being tracked. You can open a 
bz if you want to.


> I am a little surprised that the "-a always,exit" doesn't cause an
> error. I wonder if it works correctly - maybe auditctl code is smart
> enough to overcome syntactic dyslexia? :)

I was always mixing up the order when writing rules, so I fixed auditctl to 
take it in either order. Its been like this for 3-4 years.

-Steve