From mboxrd@z Thu Jan 1 00:00:00 1970 From: LC Bruzenak Subject: Re: ausearch on aggregation - syscall difference Date: Fri, 24 Oct 2008 12:27:49 -0500 Message-ID: <1224869269.9388.19.camel@homeserver> References: <1224868121.9388.8.camel@homeserver> <200810241316.21804.sgrubb@redhat.com> Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <200810241316.21804.sgrubb@redhat.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Steve Grubb Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Fri, 2008-10-24 at 13:16 -0400, Steve Grubb wrote: > On Friday 24 October 2008 13:08:41 LC Bruzenak wrote: > > Note that the syscall is listed differently. > > Interesting. > > > > This is using the 1.7.7 code (on F9), I have not yet moved over to 1.7.8 > > in case it may be fixed there. > > Nope...nothing was changed there to fix it. This is the first I'd heard of the > problem..Can you show me the raw record? > > ausearch -ts today -a 10038 --raw > > Thanks, > -Steve I noticed it because with the audit-viewer I cannot see the "msg=" part of TRUSTED_APP records. I submitted a bugtraq (https://fedorahosted.org/audit-viewer/ticket/6) for that. So, that made me look at the ausearch results to get all the info. Additionally, I believe there is a policy issue which caused this in the first place... >>From the aggregating machine: [root@dell1 ~]# ausearch -ts today -a 10038 --raw node=v1 type=AVC msg=audit(1224864719.162:10038): avc: denied { read } for pid=11761 comm="prelude-manager" laddr=127.0.0.1 lport=4690 faddr=127.0.0.1 fport=36291 scontext=system_u:system_r:prelude_t:s0-s15:c0.c1023 tcontext=system_u:system_r:prelude_t:s15:c0.c1023 tclass=tcp_socket node=v1 type=SYSCALL msg=audit(1224864719.162:10038): arch=40000003 syscall=102 success=yes exit=5 a0=a a1=bfcc1f80 a2=25b0c4 a3=0 items=0 ppid=1 pid=11761 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="prelude-manager" exe="/usr/bin/prelude-manager" subj=system_u:system_r:prelude_t:s0-s15:c0.c1023 key=(null) >>From the originating machine: [root@v1 ~]# ausearch -ts today -a 10038 --raw node=v1 type=AVC msg=audit(1224864719.162:10038): avc: denied { read } for pid=11761 comm="prelude-manager" laddr=127.0.0.1 lport=4690 faddr=127.0.0.1 fport=36291 scontext=system_u:system_r:prelude_t:s0-s15:c0.c1023 tcontext=system_u:system_r:prelude_t:s15:c0.c1023 tclass=tcp_socket node=v1 type=SYSCALL msg=audit(1224864719.162:10038): arch=40000003 syscall=102 success=yes exit=5 a0=a a1=bfcc1f80 a2=25b0c4 a3=0 items=0 ppid=1 pid=11761 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="prelude-manager" exe="/usr/bin/prelude-manager" subj=system_u:system_r:prelude_t:s0-s15:c0.c1023 key=(null) So it looks like the architectures interpretation (-i) of the syscall is where it differs? Thx, LCB. -- LC (Lenny) Bruzenak lenny@magitekltd.com