From mboxrd@z Thu Jan 1 00:00:00 1970 From: LC Bruzenak Subject: Re: audit 1.7.4 released Date: Tue, 27 May 2008 12:20:17 -0500 Message-ID: <1211908817.6568.64.camel@homeserver> References: <200805191450.06153.sgrubb@redhat.com> <200805271210.04007.sgrubb@redhat.com> <1211904978.6568.53.camel@homeserver> <200805271225.26610.sgrubb@redhat.com> Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <200805271225.26610.sgrubb@redhat.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Steve Grubb Cc: Linux Audit List-Id: linux-audit@redhat.com On Tue, 2008-05-27 at 12:25 -0400, Steve Grubb wrote: > On Tuesday 27 May 2008 12:16:18 LC Bruzenak wrote: > > > That is why we added the node field. :) You should probably enable it > > > with the name_format option. > > > > I think I do have it: > > > > [root@hugo audit]# grep name_format /etc/audit/auditd.conf > > name_format = hostname > > You may also need to make the same change in > /etc/audisp/audispd.conf. > > -Steve I thought this would solve it since for some reason I had "HOSTNAME" vice "hostname". I thought I had copied your instructions in the HOWTO, but when I checked, it is lower case. I rotated the logs, removed the old one, restarted audit, rebooted and still see nothing unique: [root@hugo ~]# grep name_format /etc/audi*/*.conf /etc/audisp/audispd.conf:name_format = hostname /etc/audit/auditd.conf:name_format = hostname [root@hugo ~]# ausearch -hn 0.0.0.0 -i --just-one ---- type=SOCKADDR msg=audit(05/27/2008 12:05:12.483:1299) : saddr=inet host:0.0.0.0 serv:708 type=SYSCALL msg=audit(05/27/2008 12:05:12.483:1299) : arch=x86_64 syscall=bind success=no exit=-98(Address already in use) a0=5 a1=7fff0d16b6c0 a2=10 a3=89ea70 items=0 ppid=1 pid=2645 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=4294967295 comm=rpc.rquotad exe=/usr/sbin/rpc.rquotad subj=system_u:system_r:initrc_t:s0-s15:c0.c1023 key=(null) type=AVC msg=audit(05/27/2008 12:05:12.483:1299) : avc: denied { name_bind } for pid=2645 comm=rpc.rquotad src=708 scontext=system_u:system_r:initrc_t:s0-s15:c0.c1023 tcontext=system_u:object_r:hi_reserved_port_t:s0 tclass=udp_socket [root@hugo ~]# ausearch -hn 127.0.0.1 -i --just-one ---- type=SOCKADDR msg=audit(05/27/2008 12:05:12.359:1296) : saddr=inet host:127.0.0.1 serv:748 type=SYSCALL msg=audit(05/27/2008 12:05:12.359:1296) : arch=x86_64 syscall=sendto success=yes exit=28 a0=6 a1=7f16f44936e0 a2=1c a3=0 items=0 ppid=1 pid=2187 auid=unset uid=rpc gid=root euid=rpc suid=rpc fsuid=rpc egid=root sgid=root fsgid=root tty=(none) ses=4294967295 comm=rpcbind exe=/sbin/rpcbind subj=system_u:system_r:initrc_t:s0-s15:c0.c1023 key=(null) type=AVC msg=audit(05/27/2008 12:05:12.359:1296) : avc: denied { recvfrom } for pid=2187 comm=rpcbind saddr=127.0.0.1 src=111 daddr=127.0.0.1 dest=748 netif=lo scontext=system_u:system_r:nfsd_t:s0-s15:c0.c1023 tcontext=system_u:system_r:initrc_t:s0-s15:c0.c1023 tclass=association [root@hugo ~]# ausearch -hn 127.0.0.1 -i --just-one | grep host type=SOCKADDR msg=audit(05/27/2008 12:05:12.359:1296) : saddr=inet host:127.0.0.1 serv:748 [root@hugo ~]# ausearch -hn 0.0.0.0 -i --just-one | grep host type=SOCKADDR msg=audit(05/27/2008 12:05:12.483:1299) : saddr=inet host:0.0.0.0 serv:708 Appreciate the help; got more? :) Thx, LCB. -- LC (Lenny) Bruzenak lenny@magitekltd.com