Re: audit 1.7.4 released

[LC Bruzenak <lenny@magitekltd.com>]

On Tue, 2008-05-27 at 12:25 -0400, Steve Grubb wrote:
> On Tuesday 27 May 2008 12:16:18 LC Bruzenak wrote:
> > > That is why we added the node field. :)  You should probably enable it
> > > with the name_format option.
> >
> > I think I do have it:
> >
> > [root@hugo audit]# grep name_format /etc/audit/auditd.conf
> > name_format = hostname
> 
> You may also need to make the same change in 
> /etc/audisp/audispd.conf.
> 
> -Steve

I thought this would solve it since for some reason I had "HOSTNAME"
vice "hostname". I thought I had copied your instructions in the HOWTO,
but when I checked, it is lower case. I rotated the logs, removed the
old one, restarted audit, rebooted and still see nothing unique:

[root@hugo ~]# grep name_format /etc/audi*/*.conf
/etc/audisp/audispd.conf:name_format = hostname
/etc/audit/auditd.conf:name_format = hostname

[root@hugo ~]# ausearch -hn 0.0.0.0 -i --just-one
----
type=SOCKADDR msg=audit(05/27/2008 12:05:12.483:1299) : saddr=inet
host:0.0.0.0 serv:708 
type=SYSCALL msg=audit(05/27/2008 12:05:12.483:1299) : arch=x86_64
syscall=bind success=no exit=-98(Address already in use) a0=5
a1=7fff0d16b6c0 a2=10 a3=89ea70 items=0 ppid=1 pid=2645 auid=unset
uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root
fsgid=root tty=(none) ses=4294967295 comm=rpc.rquotad
exe=/usr/sbin/rpc.rquotad
subj=system_u:system_r:initrc_t:s0-s15:c0.c1023 key=(null) 
type=AVC msg=audit(05/27/2008 12:05:12.483:1299) : avc:  denied
{ name_bind } for  pid=2645 comm=rpc.rquotad src=708
scontext=system_u:system_r:initrc_t:s0-s15:c0.c1023
tcontext=system_u:object_r:hi_reserved_port_t:s0 tclass=udp_socket 

[root@hugo ~]# ausearch -hn 127.0.0.1 -i --just-one
----
type=SOCKADDR msg=audit(05/27/2008 12:05:12.359:1296) : saddr=inet
host:127.0.0.1 serv:748 
type=SYSCALL msg=audit(05/27/2008 12:05:12.359:1296) : arch=x86_64
syscall=sendto success=yes exit=28 a0=6 a1=7f16f44936e0 a2=1c a3=0
items=0 ppid=1 pid=2187 auid=unset uid=rpc gid=root euid=rpc suid=rpc
fsuid=rpc egid=root sgid=root fsgid=root tty=(none) ses=4294967295
comm=rpcbind exe=/sbin/rpcbind
subj=system_u:system_r:initrc_t:s0-s15:c0.c1023 key=(null) 
type=AVC msg=audit(05/27/2008 12:05:12.359:1296) : avc:  denied
{ recvfrom } for  pid=2187 comm=rpcbind saddr=127.0.0.1 src=111
daddr=127.0.0.1 dest=748 netif=lo
scontext=system_u:system_r:nfsd_t:s0-s15:c0.c1023
tcontext=system_u:system_r:initrc_t:s0-s15:c0.c1023 tclass=association 

[root@hugo ~]# ausearch -hn 127.0.0.1 -i --just-one | grep host
type=SOCKADDR msg=audit(05/27/2008 12:05:12.359:1296) : saddr=inet
host:127.0.0.1 serv:748 
[root@hugo ~]# ausearch -hn 0.0.0.0 -i --just-one | grep host
type=SOCKADDR msg=audit(05/27/2008 12:05:12.483:1299) : saddr=inet
host:0.0.0.0 serv:708 

Appreciate the help; got more?
:)

Thx,
LCB.

-- 
LC (Lenny) Bruzenak
lenny@magitekltd.com