From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Roger Holm" Subject: Audit rule problem Date: Tue, 17 Jul 2007 16:05:12 +0200 Message-ID: <18E448B8ECD0894EBB7498C0B0A53D1A012653C0@EX01.ongame.com> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============0123767048==" Return-path: Received: from mx2.redhat.com (mx2.redhat.com [10.255.15.25]) by int-mx2.corp.redhat.com (8.13.1/8.13.1) with ESMTP id l6HE5GtB019861 for ; Tue, 17 Jul 2007 10:05:16 -0400 Received: from smtp.bwin.se (smtp.bwin.se [212.112.184.253]) by mx2.redhat.com (8.13.1/8.13.1) with ESMTP id l6HE5EYw014110 for ; Tue, 17 Jul 2007 10:05:14 -0400 Content-class: urn:content-classes:message List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com This is a multi-part message in MIME format. --===============0123767048== Content-class: urn:content-classes:message Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C7C87B.7E856BA5" This is a multi-part message in MIME format. ------_=_NextPart_001_01C7C87B.7E856BA5 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hello. =20 I wonder if someone can help me with an audit rule issue?=20 =20 I want to log if someone uses the rpm command (to install/upgrade packages), but not the rest of commands. Only the rpm command!=20 Is it possible? If so, can anyone please tell me how to write the rule string? I've searched the internet, without success. =20 =20 Regards =20 Roger Holm =20 ------_=_NextPart_001_01C7C87B.7E856BA5 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Hello.

I wonder if someone can help me with an audit = rule issue?

I want to log if someone uses the rpm command = (to install/upgrade packages), but not the rest of commands. Only the rpm = command!

Is it possible? If so, can anyone please tell = me how to write the rule string? I’ve searched the internet, without = success.

Regards

Roger Holm

------_=_NextPart_001_01C7C87B.7E856BA5-- --===============0123767048== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============0123767048==-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: Audit rule problem Date: Thu, 19 Jul 2007 09:17:49 -0400 Message-ID: <200707190917.49228.sgrubb@redhat.com> References: <18E448B8ECD0894EBB7498C0B0A53D1A012653C0@EX01.ongame.com> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <18E448B8ECD0894EBB7498C0B0A53D1A012653C0@EX01.ongame.com> Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com Cc: Roger Holm List-Id: linux-audit@redhat.com On Tuesday 17 July 2007 10:05:12 Roger Holm wrote: > I want to log if someone uses the rpm command (to install/upgrade > packages), but not the rest of commands. Only the rpm command! Sure: -w /bin/rpm -p x -k rpm-is-running I added the key to make searching for the results easier. It also helps you know why the audit record was logged. -Steve From mboxrd@z Thu Jan 1 00:00:00 1970 From: Valdis.Kletnieks@vt.edu Subject: Re: Audit rule problem Date: Thu, 19 Jul 2007 13:59:16 -0400 Message-ID: <1327.1184867956@turing-police.cc.vt.edu> References: <18E448B8ECD0894EBB7498C0B0A53D1A012653C0@EX01.ongame.com> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============1435158360==" Return-path: Received: from mx2.redhat.com (mx2.redhat.com [10.255.15.25]) by int-mx2.corp.redhat.com (8.13.1/8.13.1) with ESMTP id l6JHxJ28005897 for ; Thu, 19 Jul 2007 13:59:19 -0400 Received: from turing-police.cc.vt.edu (turing-police.cc.vt.edu [128.173.14.107]) by mx2.redhat.com (8.13.1/8.13.1) with ESMTP id l6JHxIlj004737 for ; Thu, 19 Jul 2007 13:59:18 -0400 In-Reply-To: Your message of "Tue, 17 Jul 2007 16:05:12 +0200." <18E448B8ECD0894EBB7498C0B0A53D1A012653C0@EX01.ongame.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Roger Holm Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com --===============1435158360== Content-Type: multipart/signed; boundary="==_Exmh_1184867955_3444P"; micalg=pgp-sha1; protocol="application/pgp-signature" Content-Transfer-Encoding: 7bit --==_Exmh_1184867955_3444P Content-Type: text/plain; charset=us-ascii On Tue, 17 Jul 2007 16:05:12 +0200, Roger Holm said: > I want to log if someone uses the rpm command (to install/upgrade > packages), but not the rest of commands. Only the rpm command! What do you want it to do if they use 'yum' instead of 'rpm', or 'cp /bin/rpm /bin/innocent; /bin/innocent -Uvh evil-0.99.3.noarch.rpm'? --==_Exmh_1184867955_3444P Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (GNU/Linux) Comment: Exmh version 2.5 07/13/2001 iD8DBQFGn6ZzcC3lWbTT17ARAmTfAKCfumrUaRrdTN4V809sItAP0lBakQCeOYl/ +MFa3/dzEBjIFL/m5I99xAs= =xq9O -----END PGP SIGNATURE----- --==_Exmh_1184867955_3444P-- --===============1435158360== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============1435158360==-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: LC Bruzenak Subject: audit rule problem Date: Tue, 14 Nov 2017 17:38:48 -0700 Message-ID: Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============5282352462257717268==" Return-path: Received: from mx1.redhat.com (ext-mx07.extmail.prod.ext.phx2.redhat.com [10.5.110.31]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 02B268B6BC for ; Wed, 15 Nov 2017 00:38:49 +0000 (UTC) Received: from mail-it0-f51.google.com (mail-it0-f51.google.com [209.85.214.51]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id D6B73C04AC56 for ; Wed, 15 Nov 2017 00:38:48 +0000 (UTC) Received: by mail-it0-f51.google.com with SMTP id f187so15931576itb.1 for ; Tue, 14 Nov 2017 16:38:48 -0800 (PST) Received: from [192.168.13.3] ([216.158.249.3]) by smtp.googlemail.com with ESMTPSA id 23sm4102476iot.58.2017.11.14.16.38.46 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 14 Nov 2017 16:38:46 -0800 (PST) List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: "linux-audit@redhat.com" List-Id: linux-audit@redhat.com This is a cryptographically signed message in MIME format. --===============5282352462257717268== Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="------------ms000402090002070805030908" This is a cryptographically signed message in MIME format. --------------ms000402090002070805030908 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: quoted-printable System: Linux audit 2.6.32-696.3.2.el6.x86_64 #1 SMP Wed Jun 7 11:51:39 EDT 2017 = x86_64 x86_64 x86_64 GNU/Linux userspace audit-2.4.5-3 Red Hat Enterprise Linux Client release 6.9 (Santiago) I changed this line in /etc/audit/audit.rules from: -a exit,always -F arch=3Db64 -S mount -S umount2 -k mount to this: -a exit,always -F arch=3Db64 -S mount -S umount2 -F subj_type!=3Dnothing= _t=20 -k mount Reloaded my rules, and now doing (as root): # umount /boot; mount /boot no longer produces audit events. I did this because on another system=20 (mls policy, with lots of custom types) I lost the events once I=20 included some custom types installed and operational on the system, so I = was just trying to reduce this to a reproducible case. I can almost see=20 that a non-existent type might fail, but it maybe should fail to load.?. However, the bigger problem is that trying to add my other valid custom=20 types into the exclusion on the mls policy machine is causing me to lose = events. Any ideas? Thx, LCB --=20 LC (Lenny) Bruzenak lenny@magitekltd.com --------------ms000402090002070805030908 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC CjYwggURMIID+aADAgECAhMGmAB9vFXMVhuV6WtBTbdc6jXOMA0GCSqGSIb3DQEBCwUAMIGk MQswCQYDVQQGEwJVUzERMA8GA1UECBMISWxsaW5vaXMxEDAOBgNVBAcTB0NoaWNhZ28xITAf BgNVBAoTGFRydXN0d2F2ZSBIb2xkaW5ncywgSW5jLjEsMCoGA1UEAxMjVHJ1c3R3YXZlIFMv TUlNRSBTSEEyNTYgQ0EsIExldmVsIDExHzAdBgkqhkiG9w0BCQEWEGNhQHRydXN0d2F2ZS5j b20wHhcNMTYwODA1MjIxNzM3WhcNMTgwODA3MDQxNzM3WjBxMR0wGwYDVQQDDBRsZW5ueUBt YWdpdGVrbHRkLmNvbTEOMAwGA1UEChMFc21pbWUxDjAMBgNVBAgTBXNtaW1lMQswCQYDVQQG EwJVUzEjMCEGCSqGSIb3DQEJARYUbGVubnlAbWFnaXRla2x0ZC5jb20wggEiMA0GCSqGSIb3 DQEBAQUAA4IBDwAwggEKAoIBAQC1z/6sK4AyvLsKc+nsb/Q+1grKN1YfXkZ52DcCKuYHuE07 UtacuoiCyUFxJi/Rt75V5CjSwV8XCBAqPv6N4M2rJs4nDnDr2FLvQTameAVJA8mPpDzGinmI nnpaPp7+TBBkPDN0B6hFRDYl4msYtCjxGtwYGATcuXTvHH+kaoJttrD2IfVMHc/8rhnS8HGN g0P4HDH4eOj7f2WnBRkeX8z+xDy5qG811ZM/R/PXIkchVxBI110s55jnygC9vrmigmoYJLUT zr7U9iGP2NjGLqfNnzvi+MF33UE04fd59/TkkulMV/9onG5633/Zq0Lejax99odLV0DcmtTI 9eg5sW4zAgMBAAGjggFsMIIBaDAMBgNVHRMBAf8EAjAAMA4GA1UdDwEB/wQEAwIFoDATBgNV HSUEDDAKBggrBgEFBQcDBDAdBgNVHQ4EFgQU5BxVPxDRpJyVcVSIjYvO27pZyFEwHwYDVR0j BBgwFoAUDDOjV6rjq9ZLcBs2nqPtYVDmr3QwSAYDVR0gBEEwPzA9Bg8rBgEEAYHtGAMDAwUE AwMwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly9zc2wudHJ1c3R3YXZlLmNvbS9DQTA2BgNVHR8E LzAtMCugKaAnhiVodHRwOi8vY3JsLnRydXN0d2F2ZS5jb20vU01DQTJfTDEuY3JsMHEGCCsG AQUFBwEBBGUwYzAmBggrBgEFBQcwAYYaaHR0cDovL29jc3AudHJ1c3R3YXZlLmNvbS8wOQYI KwYBBQUHMAKGLWh0dHA6Ly9zc2wudHJ1c3R3YXZlLmNvbS9pc3N1ZXJzL1NNQ0EyX0wxLmNy dDANBgkqhkiG9w0BAQsFAAOCAQEAsjvHmaMBzo5CY0XqLbzfjmyO8Tjv/hNdEOCAZZh/CLei V8OgHXjVnM6icldxsVUGu+N6KLdbMQu7d6aPMA9xkdMxj4/DB4rEvNfrA7XvtSDPqGWwwKGv zPmuwO+9nQappS9beCOaWGb8MExpWJWLq6S44B9iHYtow/X8KvQtqsFbagdlEAnS3slaO754 CuMfmvQ+2huHufLqmWIIM0pQorLTosgZvEHje5IDr/YU3OVWcm6knvNnLwY+inm32h/imXps iXn0//pGawsShmCPY52amn8GpJlgHooYpEtXFE517bDW/2mR278XOHoBugqu1cpw4WPlULGX WyFc1Un6zjCCBR0wggQFoAMCAQICEDqDtx7gLDzKHOGiZD6bZuowDQYJKoZIhvcNAQELBQAw gYIxCzAJBgNVBAYTAlVTMR4wHAYDVQQLExV3d3cueHJhbXBzZWN1cml0eS5jb20xJDAiBgNV BAoTG1hSYW1wIFNlY3VyaXR5IFNlcnZpY2VzIEluYzEtMCsGA1UEAxMkWFJhbXAgR2xvYmFs IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTE0MTAwMTE5MjIzOFoXDTI0MDkyODE5MjIz OFowgaQxCzAJBgNVBAYTAlVTMREwDwYDVQQIEwhJbGxpbm9pczEQMA4GA1UEBxMHQ2hpY2Fn bzEhMB8GA1UEChMYVHJ1c3R3YXZlIEhvbGRpbmdzLCBJbmMuMSwwKgYDVQQDEyNUcnVzdHdh dmUgUy9NSU1FIFNIQTI1NiBDQSwgTGV2ZWwgMTEfMB0GCSqGSIb3DQEJARYQY2FAdHJ1c3R3 YXZlLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOHOSOYIg9MBIfkbqCyC ZA+2upgZZvmM07V0nnxno1VWLaY3JZFJeAuIRH0DAlHKwZ1NzkR1aa14v0PNnSjRT2nPBSPW 4/JratHI3Ug31ySn3X+dsD1504wEsCsoSbfgqCYpPhc+9igJI8YvjlEqVnUAXgEK2nW7buFB hU4D3LlP3MKRfCdIOAhpP7GlSpJCTaaucKqX0EWJdNuRcim85kY6oQf02qaB5WxzEO2nqGfq rQwvnlpxNwKk1B8deGeX3oIy0EZj1qqnXmWn7YaLoJWxLh7eAHss3n0wzcMl41IkQ/59JGjT VvpXLC6cO6LsNTlPJsENAuy6DyZY6V0Y7zsCAwEAAaOCAWkwggFlMBIGA1UdEwEB/wQIMAYB Af8CAQAwHQYDVR0OBBYEFAwzo1eq46vWS3AbNp6j7WFQ5q90MA4GA1UdDwEB/wQEAwIBhjBI BgNVHSAEQTA/MD0GDysGAQQBge0YAwMDBQQDAzAqMCgGCCsGAQUFBwIBFhxodHRwczovL3Nz bC50cnVzdHdhdmUuY29tL0NBMDIGA1UdHwQrMCkwJ6AloCOGIWh0dHA6Ly9jcmwudHJ1c3R3 YXZlLmNvbS9YR0NBLmNybDBsBggrBgEFBQcBAQRgMF4wJQYIKwYBBQUHMAGGGWh0dHA6Ly9v Y3NwLnRydXN0d2F2ZS5jb20wNQYIKwYBBQUHMAKGKWh0dHA6Ly9zc2wudHJ1c3R3YXZlLmNv bS9pc3N1ZXJzL1hHQ0EuY3J0MBMGA1UdJQQMMAoGCCsGAQUFBwMEMB8GA1UdIwQYMBaAFMZP oj0GY4QJnM5i5ASsjVy16bYbMA0GCSqGSIb3DQEBCwUAA4IBAQCHRix7n1HoMxSlQUFVrN2A CBagnCb3WpNeEzESJsSbJ0Fi8/oyFtKJQtCQE2OjYMQG4yCQOMLVv7QPq4BOlnAOct2yzd20 TEFQ0rul9uoZFY78KOP1WMpDqd3vQqpX3oCQLK6gUCl5FKRG2BJpqK18Y+v++Hv/8cF089F0 tAUvXF4TjZU0H38iZzHi2rp80EtcfzLwC3zwhwmQkznyw5sMpSrRx7vldirNB1fma8wgUUeV tzIRk1Oz6TRDEMMhhfjBuXmU3dI8sTkjo2l0Ju4g4dLRv4imWXoJ+QITXWhxO+EBB04yvrXi 0JaOtEBgZHnMs2pIFWGfxM2pc/J0MIQgMYIEZTCCBGECAQEwgbwwgaQxCzAJBgNVBAYTAlVT MREwDwYDVQQIEwhJbGxpbm9pczEQMA4GA1UEBxMHQ2hpY2FnbzEhMB8GA1UEChMYVHJ1c3R3 YXZlIEhvbGRpbmdzLCBJbmMuMSwwKgYDVQQDEyNUcnVzdHdhdmUgUy9NSU1FIFNIQTI1NiBD QSwgTGV2ZWwgMTEfMB0GCSqGSIb3DQEJARYQY2FAdHJ1c3R3YXZlLmNvbQITBpgAfbxVzFYb lelrQU23XOo1zjANBglghkgBZQMEAgEFAKCCAnkwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEH ATAcBgkqhkiG9w0BCQUxDxcNMTcxMTE1MDAzODQ4WjAvBgkqhkiG9w0BCQQxIgQgb3JnTrOp xiHVw/YsL1vp0eUNpl85iRxVuNZgrKlkCVkwbAYJKoZIhvcNAQkPMV8wXTALBglghkgBZQME ASowCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqGSIb3DQMCAgIAgDANBggqhkiG9w0D AgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBzQYJKwYBBAGCNxAEMYG/MIG8MIGkMQsw CQYDVQQGEwJVUzERMA8GA1UECBMISWxsaW5vaXMxEDAOBgNVBAcTB0NoaWNhZ28xITAfBgNV BAoTGFRydXN0d2F2ZSBIb2xkaW5ncywgSW5jLjEsMCoGA1UEAxMjVHJ1c3R3YXZlIFMvTUlN RSBTSEEyNTYgQ0EsIExldmVsIDExHzAdBgkqhkiG9w0BCQEWEGNhQHRydXN0d2F2ZS5jb20C EwaYAH28VcxWG5Xpa0FNt1zqNc4wgc8GCyqGSIb3DQEJEAILMYG/oIG8MIGkMQswCQYDVQQG EwJVUzERMA8GA1UECBMISWxsaW5vaXMxEDAOBgNVBAcTB0NoaWNhZ28xITAfBgNVBAoTGFRy dXN0d2F2ZSBIb2xkaW5ncywgSW5jLjEsMCoGA1UEAxMjVHJ1c3R3YXZlIFMvTUlNRSBTSEEy NTYgQ0EsIExldmVsIDExHzAdBgkqhkiG9w0BCQEWEGNhQHRydXN0d2F2ZS5jb20CEwaYAH28 VcxWG5Xpa0FNt1zqNc4wDQYJKoZIhvcNAQEBBQAEggEAbPA9tXOtSg6I0MDYxCnnZpekDOXD 5RLIpbl4FhGRti7Ccc6XzEs2jbbg/eKTdWicKBQsr40Lbms3nHxxjPWuhgBzsne6lA4SlPwb ykoINza1C7P4u9IU2gMTYFZT9o3QqbAlNCTmollHOL8WrLvOWOB92Q2NDwBdxelBDwwxglao MfAQQIkemIU7kZJrWERBlirBtxZHn+d3kN49i3HTPLZ1qFIM2Bjt/bZh7WydrVnep+iYNmaT DefbdOqo/ZqDNw7+vQ+S+3vNWyZ10argZ/HYiHJasD0uQg+U1L2bL33iuUf70sxKqx5x8sKI jV0CdnVr5Gt6pHFFknHuxy95IgAAAAAAAA== --------------ms000402090002070805030908-- --===============5282352462257717268== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============5282352462257717268==-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: LC Bruzenak Subject: Re: audit rule problem Date: Wed, 15 Nov 2017 10:06:31 -0700 Message-ID: <479ba29c-7b23-1d55-281d-8f1a2a9c4582@magitekltd.com> References: Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============5614249226982271583==" Return-path: Received: from mx1.redhat.com (ext-mx04.extmail.prod.ext.phx2.redhat.com [10.5.110.28]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 064E899AF9 for ; Wed, 15 Nov 2017 17:06:32 +0000 (UTC) Received: from mail-it0-f54.google.com (mail-it0-f54.google.com [209.85.214.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id C14057EA8B for ; Wed, 15 Nov 2017 17:06:30 +0000 (UTC) Received: by mail-it0-f54.google.com with SMTP id r127so2543377itb.5 for ; Wed, 15 Nov 2017 09:06:30 -0800 (PST) Received: from [192.168.13.3] ([216.158.249.3]) by smtp.googlemail.com with ESMTPSA id e142sm6878003ite.28.2017.11.15.09.06.28 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 15 Nov 2017 09:06:28 -0800 (PST) In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: "linux-audit@redhat.com" List-Id: linux-audit@redhat.com This is a cryptographically signed message in MIME format. --===============5614249226982271583== Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="------------ms040609060802050802000307" This is a cryptographically signed message in MIME format. --------------ms040609060802050802000307 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: quoted-printable On 11/14/2017 05:38 PM, LC Bruzenak wrote: > System: > Linux audit 2.6.32-696.3.2.el6.x86_64 #1 SMP Wed Jun 7 11:51:39 EDT=20 > 2017 x86_64 x86_64 x86_64 GNU/Linux > userspace audit-2.4.5-3 > Red Hat Enterprise Linux Client release 6.9 (Santiago) > > I changed this line in /etc/audit/audit.rules from: > -a exit,always -F arch=3Db64 -S mount -S umount2 -k mount > to this: > -a exit,always -F arch=3Db64 -S mount -S umount2 -F=20 > subj_type!=3Dnothing_t -k mount > > Reloaded my rules, and now doing (as root): > # umount /boot; mount /boot > > no longer produces audit events. I did this because on another system=20 > (mls policy, with lots of custom types) I lost the events once I=20 > included some custom types installed and operational on the system, so = > I was just trying to reduce this to a reproducible case. I can almost=20 > see that a non-existent type might fail, but it maybe should fail to=20 > load.?. Ugh. Looks like the entire problem was a non-existent subject type; I had a=20 typo in the mls policy case. So the rules accept a type which does not exist, does not warn, and then = fails to report all events. That's my story and I'm sticking to it... Thx, LCB --=20 LC (Lenny) Bruzenak lenny@magitekltd.com --------------ms040609060802050802000307 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC CjYwggURMIID+aADAgECAhMGmAB9vFXMVhuV6WtBTbdc6jXOMA0GCSqGSIb3DQEBCwUAMIGk MQswCQYDVQQGEwJVUzERMA8GA1UECBMISWxsaW5vaXMxEDAOBgNVBAcTB0NoaWNhZ28xITAf BgNVBAoTGFRydXN0d2F2ZSBIb2xkaW5ncywgSW5jLjEsMCoGA1UEAxMjVHJ1c3R3YXZlIFMv TUlNRSBTSEEyNTYgQ0EsIExldmVsIDExHzAdBgkqhkiG9w0BCQEWEGNhQHRydXN0d2F2ZS5j b20wHhcNMTYwODA1MjIxNzM3WhcNMTgwODA3MDQxNzM3WjBxMR0wGwYDVQQDDBRsZW5ueUBt YWdpdGVrbHRkLmNvbTEOMAwGA1UEChMFc21pbWUxDjAMBgNVBAgTBXNtaW1lMQswCQYDVQQG EwJVUzEjMCEGCSqGSIb3DQEJARYUbGVubnlAbWFnaXRla2x0ZC5jb20wggEiMA0GCSqGSIb3 DQEBAQUAA4IBDwAwggEKAoIBAQC1z/6sK4AyvLsKc+nsb/Q+1grKN1YfXkZ52DcCKuYHuE07 UtacuoiCyUFxJi/Rt75V5CjSwV8XCBAqPv6N4M2rJs4nDnDr2FLvQTameAVJA8mPpDzGinmI nnpaPp7+TBBkPDN0B6hFRDYl4msYtCjxGtwYGATcuXTvHH+kaoJttrD2IfVMHc/8rhnS8HGN g0P4HDH4eOj7f2WnBRkeX8z+xDy5qG811ZM/R/PXIkchVxBI110s55jnygC9vrmigmoYJLUT zr7U9iGP2NjGLqfNnzvi+MF33UE04fd59/TkkulMV/9onG5633/Zq0Lejax99odLV0DcmtTI 9eg5sW4zAgMBAAGjggFsMIIBaDAMBgNVHRMBAf8EAjAAMA4GA1UdDwEB/wQEAwIFoDATBgNV HSUEDDAKBggrBgEFBQcDBDAdBgNVHQ4EFgQU5BxVPxDRpJyVcVSIjYvO27pZyFEwHwYDVR0j BBgwFoAUDDOjV6rjq9ZLcBs2nqPtYVDmr3QwSAYDVR0gBEEwPzA9Bg8rBgEEAYHtGAMDAwUE AwMwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly9zc2wudHJ1c3R3YXZlLmNvbS9DQTA2BgNVHR8E LzAtMCugKaAnhiVodHRwOi8vY3JsLnRydXN0d2F2ZS5jb20vU01DQTJfTDEuY3JsMHEGCCsG AQUFBwEBBGUwYzAmBggrBgEFBQcwAYYaaHR0cDovL29jc3AudHJ1c3R3YXZlLmNvbS8wOQYI KwYBBQUHMAKGLWh0dHA6Ly9zc2wudHJ1c3R3YXZlLmNvbS9pc3N1ZXJzL1NNQ0EyX0wxLmNy dDANBgkqhkiG9w0BAQsFAAOCAQEAsjvHmaMBzo5CY0XqLbzfjmyO8Tjv/hNdEOCAZZh/CLei V8OgHXjVnM6icldxsVUGu+N6KLdbMQu7d6aPMA9xkdMxj4/DB4rEvNfrA7XvtSDPqGWwwKGv zPmuwO+9nQappS9beCOaWGb8MExpWJWLq6S44B9iHYtow/X8KvQtqsFbagdlEAnS3slaO754 CuMfmvQ+2huHufLqmWIIM0pQorLTosgZvEHje5IDr/YU3OVWcm6knvNnLwY+inm32h/imXps iXn0//pGawsShmCPY52amn8GpJlgHooYpEtXFE517bDW/2mR278XOHoBugqu1cpw4WPlULGX WyFc1Un6zjCCBR0wggQFoAMCAQICEDqDtx7gLDzKHOGiZD6bZuowDQYJKoZIhvcNAQELBQAw gYIxCzAJBgNVBAYTAlVTMR4wHAYDVQQLExV3d3cueHJhbXBzZWN1cml0eS5jb20xJDAiBgNV BAoTG1hSYW1wIFNlY3VyaXR5IFNlcnZpY2VzIEluYzEtMCsGA1UEAxMkWFJhbXAgR2xvYmFs IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTE0MTAwMTE5MjIzOFoXDTI0MDkyODE5MjIz OFowgaQxCzAJBgNVBAYTAlVTMREwDwYDVQQIEwhJbGxpbm9pczEQMA4GA1UEBxMHQ2hpY2Fn bzEhMB8GA1UEChMYVHJ1c3R3YXZlIEhvbGRpbmdzLCBJbmMuMSwwKgYDVQQDEyNUcnVzdHdh dmUgUy9NSU1FIFNIQTI1NiBDQSwgTGV2ZWwgMTEfMB0GCSqGSIb3DQEJARYQY2FAdHJ1c3R3 YXZlLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOHOSOYIg9MBIfkbqCyC ZA+2upgZZvmM07V0nnxno1VWLaY3JZFJeAuIRH0DAlHKwZ1NzkR1aa14v0PNnSjRT2nPBSPW 4/JratHI3Ug31ySn3X+dsD1504wEsCsoSbfgqCYpPhc+9igJI8YvjlEqVnUAXgEK2nW7buFB hU4D3LlP3MKRfCdIOAhpP7GlSpJCTaaucKqX0EWJdNuRcim85kY6oQf02qaB5WxzEO2nqGfq rQwvnlpxNwKk1B8deGeX3oIy0EZj1qqnXmWn7YaLoJWxLh7eAHss3n0wzcMl41IkQ/59JGjT VvpXLC6cO6LsNTlPJsENAuy6DyZY6V0Y7zsCAwEAAaOCAWkwggFlMBIGA1UdEwEB/wQIMAYB Af8CAQAwHQYDVR0OBBYEFAwzo1eq46vWS3AbNp6j7WFQ5q90MA4GA1UdDwEB/wQEAwIBhjBI BgNVHSAEQTA/MD0GDysGAQQBge0YAwMDBQQDAzAqMCgGCCsGAQUFBwIBFhxodHRwczovL3Nz bC50cnVzdHdhdmUuY29tL0NBMDIGA1UdHwQrMCkwJ6AloCOGIWh0dHA6Ly9jcmwudHJ1c3R3 YXZlLmNvbS9YR0NBLmNybDBsBggrBgEFBQcBAQRgMF4wJQYIKwYBBQUHMAGGGWh0dHA6Ly9v Y3NwLnRydXN0d2F2ZS5jb20wNQYIKwYBBQUHMAKGKWh0dHA6Ly9zc2wudHJ1c3R3YXZlLmNv bS9pc3N1ZXJzL1hHQ0EuY3J0MBMGA1UdJQQMMAoGCCsGAQUFBwMEMB8GA1UdIwQYMBaAFMZP oj0GY4QJnM5i5ASsjVy16bYbMA0GCSqGSIb3DQEBCwUAA4IBAQCHRix7n1HoMxSlQUFVrN2A CBagnCb3WpNeEzESJsSbJ0Fi8/oyFtKJQtCQE2OjYMQG4yCQOMLVv7QPq4BOlnAOct2yzd20 TEFQ0rul9uoZFY78KOP1WMpDqd3vQqpX3oCQLK6gUCl5FKRG2BJpqK18Y+v++Hv/8cF089F0 tAUvXF4TjZU0H38iZzHi2rp80EtcfzLwC3zwhwmQkznyw5sMpSrRx7vldirNB1fma8wgUUeV tzIRk1Oz6TRDEMMhhfjBuXmU3dI8sTkjo2l0Ju4g4dLRv4imWXoJ+QITXWhxO+EBB04yvrXi 0JaOtEBgZHnMs2pIFWGfxM2pc/J0MIQgMYIEZTCCBGECAQEwgbwwgaQxCzAJBgNVBAYTAlVT MREwDwYDVQQIEwhJbGxpbm9pczEQMA4GA1UEBxMHQ2hpY2FnbzEhMB8GA1UEChMYVHJ1c3R3 YXZlIEhvbGRpbmdzLCBJbmMuMSwwKgYDVQQDEyNUcnVzdHdhdmUgUy9NSU1FIFNIQTI1NiBD QSwgTGV2ZWwgMTEfMB0GCSqGSIb3DQEJARYQY2FAdHJ1c3R3YXZlLmNvbQITBpgAfbxVzFYb lelrQU23XOo1zjANBglghkgBZQMEAgEFAKCCAnkwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEH ATAcBgkqhkiG9w0BCQUxDxcNMTcxMTE1MTcwNjMxWjAvBgkqhkiG9w0BCQQxIgQg+tQsT9uA 6L1MTxs3ljtx4MLzaLmZAEelCd1iOyf1v8swbAYJKoZIhvcNAQkPMV8wXTALBglghkgBZQME ASowCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqGSIb3DQMCAgIAgDANBggqhkiG9w0D AgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBzQYJKwYBBAGCNxAEMYG/MIG8MIGkMQsw CQYDVQQGEwJVUzERMA8GA1UECBMISWxsaW5vaXMxEDAOBgNVBAcTB0NoaWNhZ28xITAfBgNV BAoTGFRydXN0d2F2ZSBIb2xkaW5ncywgSW5jLjEsMCoGA1UEAxMjVHJ1c3R3YXZlIFMvTUlN RSBTSEEyNTYgQ0EsIExldmVsIDExHzAdBgkqhkiG9w0BCQEWEGNhQHRydXN0d2F2ZS5jb20C EwaYAH28VcxWG5Xpa0FNt1zqNc4wgc8GCyqGSIb3DQEJEAILMYG/oIG8MIGkMQswCQYDVQQG EwJVUzERMA8GA1UECBMISWxsaW5vaXMxEDAOBgNVBAcTB0NoaWNhZ28xITAfBgNVBAoTGFRy dXN0d2F2ZSBIb2xkaW5ncywgSW5jLjEsMCoGA1UEAxMjVHJ1c3R3YXZlIFMvTUlNRSBTSEEy NTYgQ0EsIExldmVsIDExHzAdBgkqhkiG9w0BCQEWEGNhQHRydXN0d2F2ZS5jb20CEwaYAH28 VcxWG5Xpa0FNt1zqNc4wDQYJKoZIhvcNAQEBBQAEggEADSnBKQcQMa7HyIKVCgzNda8WrUiT jzdr3uj4+fXfShx8c3QW24m8uRBJUNrASg1hsiO4dyGJqGo25nMgA/MrfY9z5ANrt8oyDknM RBPLCBKFf75LywaiWVzBypCtfqPfZ81Ch2Dj8H6oPbWk3Fe4og9shT3snBNxECvVBvCXRlb1 C71WBSPNE8qxjJDpgBVtN/adNlvGdhMUB9Rcy2ONEUomBKNu7Bj3FKYr4kRfExlpktlUtZBa oOKgigaabZVwGQhqxnDh+p0N4ubxtT5ngJAVqPXgJ1MrUXxATOwu4xnl1Yyz8bfphSVEmHtB g4donrSZZWs9aAnCEkeKyqC/EgAAAAAAAA== --------------ms040609060802050802000307-- --===============5614249226982271583== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============5614249226982271583==-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: audit rule problem Date: Wed, 15 Nov 2017 12:16:33 -0500 Message-ID: <1630988.KWtGsrzIPi@x2> References: <479ba29c-7b23-1d55-281d-8f1a2a9c4582@magitekltd.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <479ba29c-7b23-1d55-281d-8f1a2a9c4582@magitekltd.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Wednesday, November 15, 2017 12:06:31 PM EST LC Bruzenak wrote: > On 11/14/2017 05:38 PM, LC Bruzenak wrote: > > System: > > Linux audit 2.6.32-696.3.2.el6.x86_64 #1 SMP Wed Jun 7 11:51:39 EDT > > 2017 x86_64 x86_64 x86_64 GNU/Linux > > userspace audit-2.4.5-3 > > Red Hat Enterprise Linux Client release 6.9 (Santiago) > > > > I changed this line in /etc/audit/audit.rules from: > > -a exit,always -F arch=b64 -S mount -S umount2 -k mount > > to this: > > -a exit,always -F arch=b64 -S mount -S umount2 -F > > subj_type!=nothing_t -k mount > > > > Reloaded my rules, and now doing (as root): > > # umount /boot; mount /boot > > > > no longer produces audit events. I did this because on another system > > (mls policy, with lots of custom types) I lost the events once I > > included some custom types installed and operational on the system, so > > I was just trying to reduce this to a reproducible case. I can almost > > see that a non-existent type might fail, but it maybe should fail to > > load.?. > > Ugh. > Looks like the entire problem was a non-existent subject type; I had a > typo in the mls policy case. > So the rules accept a type which does not exist, does not warn, and then > fails to report all events. > That's my story and I'm sticking to it... OK. That's something that can be checked. And I confirm this is the case. [root@x2 ~]# auditctl -a always,exit -F arch=b64 -S open -F subj_type=doesnt_exist_t [root@x2 ~]# echo $? 0 [root@x2 ~]# auditctl -l | grep doesnt_exist_t -a always,exit -F arch=b64 -S open -F subj_type=doesnt_exist_t [root@x2 ~]# auditctl -d always,exit -F arch=b64 -S open -F subj_type=doesnt_exist_t That said, you can also write a rule with auid=40000 which would be an invalid user. The kernel has no concept of what uids are valid. So, I expect we have the same issue with policy. I don't know if the kernel can check if a type is valid. Typically policy is compiled into numbers and that's what the kernel understands. -Steve From mboxrd@z Thu Jan 1 00:00:00 1970 From: LC Bruzenak Subject: Re: audit rule problem Date: Wed, 15 Nov 2017 10:20:57 -0700 Message-ID: <189b774b-e238-0d4f-176a-0a0761370107@magitekltd.com> References: <479ba29c-7b23-1d55-281d-8f1a2a9c4582@magitekltd.com> <1630988.KWtGsrzIPi@x2> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============1009510810254925596==" Return-path: Received: from mx1.redhat.com (ext-mx02.extmail.prod.ext.phx2.redhat.com [10.5.110.26]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 665E9A27A4 for ; Wed, 15 Nov 2017 17:20:57 +0000 (UTC) Received: from mail-it0-f47.google.com (mail-it0-f47.google.com [209.85.214.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 9928B883C0 for ; Wed, 15 Nov 2017 17:20:56 +0000 (UTC) Received: by mail-it0-f47.google.com with SMTP id l196so2602384itl.4 for ; Wed, 15 Nov 2017 09:20:56 -0800 (PST) Received: from [192.168.13.3] ([216.158.249.3]) by smtp.googlemail.com with ESMTPSA id z95sm6900259ita.31.2017.11.15.09.20.54 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 15 Nov 2017 09:20:54 -0800 (PST) In-Reply-To: <1630988.KWtGsrzIPi@x2> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com This is a cryptographically signed message in MIME format. --===============1009510810254925596== Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="------------ms040904070508080205020105" This is a cryptographically signed message in MIME format. --------------ms040904070508080205020105 Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: quoted-printable On 11/15/2017 10:16 AM, Steve Grubb wrote: > OK. That's something that can be checked. And I confirm this is the ca= se. > > [root@x2 ~]# auditctl -a always,exit -F arch=3Db64 -S open -F subj_type= =3Ddoesnt_exist_t > [root@x2 ~]# echo $? > 0 > [root@x2 ~]# auditctl -l | grep doesnt_exist_t > -a always,exit -F arch=3Db64 -S open -F subj_type=3Ddoesnt_exist_t > [root@x2 ~]# auditctl -d always,exit -F arch=3Db64 -S open -F subj_type= =3Ddoesnt_exist_t > > That said, you can also write a rule with auid=3D40000 which would be a= n invalid > user. The kernel has no concept of what uids are valid. So, I expect we= have > the same issue with policy. I don't know if the kernel can check if a t= ype is > valid. Typically policy is compiled into numbers and that's what the ke= rnel > understands. > > -Steve Thanks Steve. I wouldn't mind as much if it accepts types not currently=20 loaded (seems like a warning would be nice though), however the part=20 about it subsequently discarding valid events due to the bogus type is=20 the troubling part. LCB --=20 LC (Lenny) Bruzenak lenny@magitekltd.com --------------ms040904070508080205020105 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC CjYwggURMIID+aADAgECAhMGmAB9vFXMVhuV6WtBTbdc6jXOMA0GCSqGSIb3DQEBCwUAMIGk MQswCQYDVQQGEwJVUzERMA8GA1UECBMISWxsaW5vaXMxEDAOBgNVBAcTB0NoaWNhZ28xITAf BgNVBAoTGFRydXN0d2F2ZSBIb2xkaW5ncywgSW5jLjEsMCoGA1UEAxMjVHJ1c3R3YXZlIFMv TUlNRSBTSEEyNTYgQ0EsIExldmVsIDExHzAdBgkqhkiG9w0BCQEWEGNhQHRydXN0d2F2ZS5j b20wHhcNMTYwODA1MjIxNzM3WhcNMTgwODA3MDQxNzM3WjBxMR0wGwYDVQQDDBRsZW5ueUBt YWdpdGVrbHRkLmNvbTEOMAwGA1UEChMFc21pbWUxDjAMBgNVBAgTBXNtaW1lMQswCQYDVQQG EwJVUzEjMCEGCSqGSIb3DQEJARYUbGVubnlAbWFnaXRla2x0ZC5jb20wggEiMA0GCSqGSIb3 DQEBAQUAA4IBDwAwggEKAoIBAQC1z/6sK4AyvLsKc+nsb/Q+1grKN1YfXkZ52DcCKuYHuE07 UtacuoiCyUFxJi/Rt75V5CjSwV8XCBAqPv6N4M2rJs4nDnDr2FLvQTameAVJA8mPpDzGinmI nnpaPp7+TBBkPDN0B6hFRDYl4msYtCjxGtwYGATcuXTvHH+kaoJttrD2IfVMHc/8rhnS8HGN g0P4HDH4eOj7f2WnBRkeX8z+xDy5qG811ZM/R/PXIkchVxBI110s55jnygC9vrmigmoYJLUT zr7U9iGP2NjGLqfNnzvi+MF33UE04fd59/TkkulMV/9onG5633/Zq0Lejax99odLV0DcmtTI 9eg5sW4zAgMBAAGjggFsMIIBaDAMBgNVHRMBAf8EAjAAMA4GA1UdDwEB/wQEAwIFoDATBgNV HSUEDDAKBggrBgEFBQcDBDAdBgNVHQ4EFgQU5BxVPxDRpJyVcVSIjYvO27pZyFEwHwYDVR0j BBgwFoAUDDOjV6rjq9ZLcBs2nqPtYVDmr3QwSAYDVR0gBEEwPzA9Bg8rBgEEAYHtGAMDAwUE AwMwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly9zc2wudHJ1c3R3YXZlLmNvbS9DQTA2BgNVHR8E LzAtMCugKaAnhiVodHRwOi8vY3JsLnRydXN0d2F2ZS5jb20vU01DQTJfTDEuY3JsMHEGCCsG AQUFBwEBBGUwYzAmBggrBgEFBQcwAYYaaHR0cDovL29jc3AudHJ1c3R3YXZlLmNvbS8wOQYI KwYBBQUHMAKGLWh0dHA6Ly9zc2wudHJ1c3R3YXZlLmNvbS9pc3N1ZXJzL1NNQ0EyX0wxLmNy dDANBgkqhkiG9w0BAQsFAAOCAQEAsjvHmaMBzo5CY0XqLbzfjmyO8Tjv/hNdEOCAZZh/CLei V8OgHXjVnM6icldxsVUGu+N6KLdbMQu7d6aPMA9xkdMxj4/DB4rEvNfrA7XvtSDPqGWwwKGv zPmuwO+9nQappS9beCOaWGb8MExpWJWLq6S44B9iHYtow/X8KvQtqsFbagdlEAnS3slaO754 CuMfmvQ+2huHufLqmWIIM0pQorLTosgZvEHje5IDr/YU3OVWcm6knvNnLwY+inm32h/imXps iXn0//pGawsShmCPY52amn8GpJlgHooYpEtXFE517bDW/2mR278XOHoBugqu1cpw4WPlULGX WyFc1Un6zjCCBR0wggQFoAMCAQICEDqDtx7gLDzKHOGiZD6bZuowDQYJKoZIhvcNAQELBQAw gYIxCzAJBgNVBAYTAlVTMR4wHAYDVQQLExV3d3cueHJhbXBzZWN1cml0eS5jb20xJDAiBgNV BAoTG1hSYW1wIFNlY3VyaXR5IFNlcnZpY2VzIEluYzEtMCsGA1UEAxMkWFJhbXAgR2xvYmFs IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTE0MTAwMTE5MjIzOFoXDTI0MDkyODE5MjIz OFowgaQxCzAJBgNVBAYTAlVTMREwDwYDVQQIEwhJbGxpbm9pczEQMA4GA1UEBxMHQ2hpY2Fn bzEhMB8GA1UEChMYVHJ1c3R3YXZlIEhvbGRpbmdzLCBJbmMuMSwwKgYDVQQDEyNUcnVzdHdh dmUgUy9NSU1FIFNIQTI1NiBDQSwgTGV2ZWwgMTEfMB0GCSqGSIb3DQEJARYQY2FAdHJ1c3R3 YXZlLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOHOSOYIg9MBIfkbqCyC ZA+2upgZZvmM07V0nnxno1VWLaY3JZFJeAuIRH0DAlHKwZ1NzkR1aa14v0PNnSjRT2nPBSPW 4/JratHI3Ug31ySn3X+dsD1504wEsCsoSbfgqCYpPhc+9igJI8YvjlEqVnUAXgEK2nW7buFB hU4D3LlP3MKRfCdIOAhpP7GlSpJCTaaucKqX0EWJdNuRcim85kY6oQf02qaB5WxzEO2nqGfq rQwvnlpxNwKk1B8deGeX3oIy0EZj1qqnXmWn7YaLoJWxLh7eAHss3n0wzcMl41IkQ/59JGjT VvpXLC6cO6LsNTlPJsENAuy6DyZY6V0Y7zsCAwEAAaOCAWkwggFlMBIGA1UdEwEB/wQIMAYB Af8CAQAwHQYDVR0OBBYEFAwzo1eq46vWS3AbNp6j7WFQ5q90MA4GA1UdDwEB/wQEAwIBhjBI BgNVHSAEQTA/MD0GDysGAQQBge0YAwMDBQQDAzAqMCgGCCsGAQUFBwIBFhxodHRwczovL3Nz bC50cnVzdHdhdmUuY29tL0NBMDIGA1UdHwQrMCkwJ6AloCOGIWh0dHA6Ly9jcmwudHJ1c3R3 YXZlLmNvbS9YR0NBLmNybDBsBggrBgEFBQcBAQRgMF4wJQYIKwYBBQUHMAGGGWh0dHA6Ly9v Y3NwLnRydXN0d2F2ZS5jb20wNQYIKwYBBQUHMAKGKWh0dHA6Ly9zc2wudHJ1c3R3YXZlLmNv bS9pc3N1ZXJzL1hHQ0EuY3J0MBMGA1UdJQQMMAoGCCsGAQUFBwMEMB8GA1UdIwQYMBaAFMZP oj0GY4QJnM5i5ASsjVy16bYbMA0GCSqGSIb3DQEBCwUAA4IBAQCHRix7n1HoMxSlQUFVrN2A CBagnCb3WpNeEzESJsSbJ0Fi8/oyFtKJQtCQE2OjYMQG4yCQOMLVv7QPq4BOlnAOct2yzd20 TEFQ0rul9uoZFY78KOP1WMpDqd3vQqpX3oCQLK6gUCl5FKRG2BJpqK18Y+v++Hv/8cF089F0 tAUvXF4TjZU0H38iZzHi2rp80EtcfzLwC3zwhwmQkznyw5sMpSrRx7vldirNB1fma8wgUUeV tzIRk1Oz6TRDEMMhhfjBuXmU3dI8sTkjo2l0Ju4g4dLRv4imWXoJ+QITXWhxO+EBB04yvrXi 0JaOtEBgZHnMs2pIFWGfxM2pc/J0MIQgMYIEZTCCBGECAQEwgbwwgaQxCzAJBgNVBAYTAlVT MREwDwYDVQQIEwhJbGxpbm9pczEQMA4GA1UEBxMHQ2hpY2FnbzEhMB8GA1UEChMYVHJ1c3R3 YXZlIEhvbGRpbmdzLCBJbmMuMSwwKgYDVQQDEyNUcnVzdHdhdmUgUy9NSU1FIFNIQTI1NiBD QSwgTGV2ZWwgMTEfMB0GCSqGSIb3DQEJARYQY2FAdHJ1c3R3YXZlLmNvbQITBpgAfbxVzFYb lelrQU23XOo1zjANBglghkgBZQMEAgEFAKCCAnkwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEH ATAcBgkqhkiG9w0BCQUxDxcNMTcxMTE1MTcyMDU3WjAvBgkqhkiG9w0BCQQxIgQgjX9ZPPfs tZJ3mS9q6lAWlFaSllLpGpwAD2D5/8i8ZhgwbAYJKoZIhvcNAQkPMV8wXTALBglghkgBZQME ASowCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqGSIb3DQMCAgIAgDANBggqhkiG9w0D AgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBzQYJKwYBBAGCNxAEMYG/MIG8MIGkMQsw CQYDVQQGEwJVUzERMA8GA1UECBMISWxsaW5vaXMxEDAOBgNVBAcTB0NoaWNhZ28xITAfBgNV BAoTGFRydXN0d2F2ZSBIb2xkaW5ncywgSW5jLjEsMCoGA1UEAxMjVHJ1c3R3YXZlIFMvTUlN RSBTSEEyNTYgQ0EsIExldmVsIDExHzAdBgkqhkiG9w0BCQEWEGNhQHRydXN0d2F2ZS5jb20C EwaYAH28VcxWG5Xpa0FNt1zqNc4wgc8GCyqGSIb3DQEJEAILMYG/oIG8MIGkMQswCQYDVQQG EwJVUzERMA8GA1UECBMISWxsaW5vaXMxEDAOBgNVBAcTB0NoaWNhZ28xITAfBgNVBAoTGFRy dXN0d2F2ZSBIb2xkaW5ncywgSW5jLjEsMCoGA1UEAxMjVHJ1c3R3YXZlIFMvTUlNRSBTSEEy NTYgQ0EsIExldmVsIDExHzAdBgkqhkiG9w0BCQEWEGNhQHRydXN0d2F2ZS5jb20CEwaYAH28 VcxWG5Xpa0FNt1zqNc4wDQYJKoZIhvcNAQEBBQAEggEAlALB0HcotzFXCzL/VTIonEQ8K6VU GkHfrM++pOKj268CVKoLWXF8D7/rt06Xkf32T4pF1Sowbdfv84rvcY5OiWuar6eBOqUXtqnp CXb+abJCcdK2ISNyv6ixUgXLSi8wLePE0DmxcjGcU7q+TGvncndtlKbgr1ya+XPXsyyBjXHt lWy1BnLtZYkhj/ACl6jQoCOqewBgAtdTFsu3/Epng0/3G2oLz/mUyfhfoZzA7wd1xvk/97MY gm77lPLylFjoWNreqFrR8oqWAp41izU+s2kt/DtiLzkd5N2A3SSIBCFQ/L5FtXB8dWCpifUs HcucooAOXbCccqkY1bsKQh0C0QAAAAAAAA== --------------ms040904070508080205020105-- --===============1009510810254925596== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============1009510810254925596==--