Re: ausearch on aggregation - syscall difference

[LC Bruzenak <lenny@magitekltd.com>]

On Fri, 2008-10-24 at 13:16 -0400, Steve Grubb wrote:
> On Friday 24 October 2008 13:08:41 LC Bruzenak wrote:
> > Note that the syscall is listed differently.
> 
> Interesting.
> 
> 
> > This is using the 1.7.7 code (on F9), I have not yet moved over to 1.7.8
> > in case it may be fixed there.
> 
> Nope...nothing was changed there to fix it. This is the first I'd heard of the 
> problem..Can you show me the raw record?
> 
> ausearch -ts today -a 10038 --raw
> 
> Thanks,
> -Steve

I noticed it because with the audit-viewer I cannot see the "msg=" part
of TRUSTED_APP records. I submitted a bugtraq
(https://fedorahosted.org/audit-viewer/ticket/6) for that. So, that made
me look at the ausearch results to get all the info.

Additionally, I believe there is a policy issue which caused this in the
first place...

>From the aggregating machine:

[root@dell1 ~]# ausearch -ts today -a 10038 --raw
node=v1 type=AVC msg=audit(1224864719.162:10038): avc:  denied  { read } for  pid=11761 comm="prelude-manager" laddr=127.0.0.1 lport=4690 faddr=127.0.0.1 fport=36291 scontext=system_u:system_r:prelude_t:s0-s15:c0.c1023 tcontext=system_u:system_r:prelude_t:s15:c0.c1023 tclass=tcp_socket
node=v1 type=SYSCALL msg=audit(1224864719.162:10038): arch=40000003 syscall=102 success=yes exit=5 a0=a a1=bfcc1f80 a2=25b0c4 a3=0 items=0 ppid=1 pid=11761 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="prelude-manager" exe="/usr/bin/prelude-manager" subj=system_u:system_r:prelude_t:s0-s15:c0.c1023 key=(null)


>From the originating machine:
[root@v1 ~]# ausearch -ts today -a 10038 --raw
node=v1 type=AVC msg=audit(1224864719.162:10038): avc:  denied  { read } for  pid=11761 comm="prelude-manager" laddr=127.0.0.1 lport=4690 faddr=127.0.0.1 fport=36291 scontext=system_u:system_r:prelude_t:s0-s15:c0.c1023 tcontext=system_u:system_r:prelude_t:s15:c0.c1023 tclass=tcp_socket 
node=v1 type=SYSCALL msg=audit(1224864719.162:10038): arch=40000003 syscall=102 success=yes exit=5 a0=a a1=bfcc1f80 a2=25b0c4 a3=0 items=0 ppid=1 pid=11761 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="prelude-manager" exe="/usr/bin/prelude-manager" subj=system_u:system_r:prelude_t:s0-s15:c0.c1023 key=(null) 


So it looks like the architectures interpretation (-i) of the syscall is
where it differs?

Thx,
LCB.

-- 
LC (Lenny) Bruzenak
lenny@magitekltd.com