From mboxrd@z Thu Jan 1 00:00:00 1970 From: leam hall Subject: SYSCALL and you...err...and me... Date: Fri, 25 Oct 2013 08:29:00 -0400 Message-ID: Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============4223353553632628774==" Return-path: Received: from mx1.redhat.com (ext-mx15.extmail.prod.ext.phx2.redhat.com [10.5.110.20]) by int-mx02.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id r9PCT2gW015289 for ; Fri, 25 Oct 2013 08:29:02 -0400 Received: from mail-pd0-f171.google.com (mail-pd0-f171.google.com [209.85.192.171]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id r9PCT1dR000999 for ; Fri, 25 Oct 2013 08:29:01 -0400 Received: by mail-pd0-f171.google.com with SMTP id w10so2090920pde.2 for ; Fri, 25 Oct 2013 05:29:01 -0700 (PDT) List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com --===============4223353553632628774== Content-Type: multipart/alternative; boundary=047d7bf0dc4825384104e98fe552 --047d7bf0dc4825384104e98fe552 Content-Type: text/plain; charset=UTF-8 I'm making a little progress in identifying the unknown syscalls. It often helps if you are not so cold and remember to look for a log... The failed call below is root doing a grep. I do not know why it failed. The PPID is a bash shell. Any good docs available to explain the codes? Thanks! Leam ### grep SYSCALL audit.log | grep "success=no" | tail -1 type=SYSCALL msg=audit(1382703881.711:2677787): arch=c000003e syscall=2 success=no exit=-2 a0=7914b20 a1=0 a2=0 a3=3a89724793 items=1 ppid=25339 pid=26563 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=4445 comm="grep" exe="/bin/grep" subj=root:system_r:unconfined_t:s0-s0:c0.c1023 key=(null) -- Mind on a Mission --047d7bf0dc4825384104e98fe552 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
I'm making a little progress in identifying the u= nknown syscalls. It often helps if you are not so cold and remember to look= for a log...

The failed call below is root doing a grep. I do= not know why it failed. The PPID is a bash shell. Any good docs available = to explain the codes?

Thanks!

Leam

###

grep SYSCALL audit.log | gre= p "success=3Dno" | tail -1

type=3DSYSCALL msg=3Daudit(1382= 703881.711:2677787): arch=3Dc000003e syscall=3D2 success=3Dno exit=3D-2 a0= =3D7914b20 a1=3D0 a2=3D0 a3=3D3a89724793 items=3D1 ppid=3D25339 pid=3D26563= auid=3D0 uid=3D0 gid=3D0 euid=3D0 suid=3D0 fsuid=3D0 egid=3D0 sgid=3D0 fsg= id=3D0 tty=3Dpts1 ses=3D4445 comm=3D"grep" exe=3D"/bin/grep&= quot; subj=3Droot:system_r:unconfined_t:s0-s0:c0.c1023 key=3D(null)

--047d7bf0dc4825384104e98fe552-- --===============4223353553632628774== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============4223353553632628774==-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: SYSCALL and you...err...and me... Date: Fri, 25 Oct 2013 08:45:56 -0400 Message-ID: <1463828.1fTBGOzZcb@x2> References: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Friday, October 25, 2013 08:29:00 AM leam hall wrote: > I'm making a little progress in identifying the unknown syscalls. It often > helps if you are not so cold and remember to look for a log... > > The failed call below is root doing a grep. I do not know why it failed. > The PPID is a bash shell. Any good docs available to explain the codes? Ausearch automatically interprets the codes for you. > grep SYSCALL audit.log | grep "success=no" | tail -1 > > type=SYSCALL msg=audit(1382703881.711:2677787): arch=c000003e syscall=2 > success=no exit=-2 a0=7914b20 a1=0 a2=0 a3=3a89724793 items=1 ppid=25339 > pid=26563 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 > tty=pts1 ses=4445 comm="grep" exe="/bin/grep" > subj=root:system_r:unconfined_t:s0-s0:c0.c1023 key=(null) Try ausearch --start today -m syscall -sv no -i -Steve From mboxrd@z Thu Jan 1 00:00:00 1970 From: Alexander Viro Subject: Re: SYSCALL and you...err...and me... Date: Fri, 25 Oct 2013 08:48:51 -0400 Message-ID: <20131025124851.GB14171@sh-el6.eng.rdu2.redhat.com> References: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Content-Disposition: inline In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: leam hall Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Fri, Oct 25, 2013 at 08:29:00AM -0400, leam hall wrote: > I'm making a little progress in identifying the unknown syscalls. It often > helps if you are not so cold and remember to look for a log... > > The failed call below is root doing a grep. I do not know why it failed. > The PPID is a bash shell. Any good docs available to explain the codes? > > Thanks! > > Leam > > ### > > grep SYSCALL audit.log | grep "success=no" | tail -1 > > type=SYSCALL msg=audit(1382703881.711:2677787): arch=c000003e syscall=2 > success=no exit=-2 a0=7914b20 a1=0 a2=0 a3=3a89724793 items=1 ppid=25339 > pid=26563 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 > tty=pts1 ses=4445 comm="grep" exe="/bin/grep" > subj=root:system_r:unconfined_t:s0-s0:c0.c1023 key=(null) open() failing with ENOENT. Which can happen for any number of reasons, such as looking for config in .some_shite before going for /etc/some_shite. Hard to tell without seeing the pathname involved...