From: Steve Grubb <sgrubb@redhat.com>
To: Kangkook Jee <aixer77@gmail.com>
Cc: linux-audit@redhat.com
Subject: Re: auditd reports port number '0' for connect() system call
Date: Fri, 01 Apr 2016 08:13:49 -0400 [thread overview]
Message-ID: <18729284.EaRmKyajcD@x2> (raw)
In-Reply-To: <58B1DB4D-2C44-4A0F-8576-E5AE9E655D05@gmail.com>
On Thursday, March 31, 2016 06:11:26 PM Kangkook Jee wrote:
> Here an event directly from auditd for connect() system call (syscall=42)
> with port number 0. Do you think connect() system call still can be called
> with port number 0?
Hello,
I got the full events. Below is the explanation...
type=SYSCALL msg=audit(03/29/2016 21:33:27.178:35720094) : arch=x86_64
syscall=socket success=yes exit=44 a0=inet a1=SOCK_DGRAM a2=ip a3=0x0 items=0
ppid=2779 pid=31713 auid=unset uid=unknown(8271) gid=unknown(5001)
euid=unknown(8271) suid=unknown(8271) fsuid=unknown(8271) egid=unknown(5001)
sgid=unknown(5001) fsgid=unknown(5001) tty=(none) ses=unset comm=DNS Res~er
#465 exe=/usr/lib/firefox/firefox key=(null)
So, here ^^^ we are creating a DGRAM socket. This is important because they
follow slightly different rules than tcp.
type=SOCKADDR msg=audit(03/29/2016 21:33:27.178:35720095) : saddr=inet
host:54.68.122.100 serv:0
type=SYSCALL msg=audit(03/29/2016 21:33:27.178:35720095) : arch=x86_64
syscall=connect success=yes exit=0 a0=0x2c a1=0x7f1fbe8f81f0 a2=0x10 a3=0x0
items=0 ppid=2779 pid=31713 auid=unset uid=unknown(8271) gid=unknown(5001)
euid=unknown(8271) suid=unknown(8271) fsuid=unknown(8271) egid=unknown(5001)
sgid=unknown(5001) fsgid=unknown(5001) tty=(none) ses=unset comm=DNS Res~er
#465 exe=/usr/lib/firefox/firefox key=(null)
http://man7.org/linux/man-pages/man2/connect.2.html
If the socket sockfd is of type SOCK_DGRAM, then addr is the address to which
datagrams are sent by default, and the only address from which datagrams are
received.
So, this is just setting up a connectionless socket to a specific server.
Judging by the thread name, this is for DNS resolution for Firefox. So, I
would say that without a doubt, this is normal system operation.
-Steve
> type=SYSCALL msg=audit(1459301607.178:35720095): arch=c000003e syscall=42
> success=yes exit=0 a0=2c a1=7f1fbe8f81f0 a2=10 a3=0 items=0 ppid=2779
> pid=31713 auid=4294967295 uid=8271 gid=5001 euid=8271 suid=8271 fsuid=8271
> egid=5001 sgid=500# type=SOCKADDR msg=audit(1459301607.178:35720095):
> saddr=0200000036447A640000000000000000
>
> If it is bind() it makes but I’m not sure we can still do this with
> connect().
>
> Thanks!
>
> /Kangkook
--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit
next prev parent reply other threads:[~2016-04-01 12:13 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-03-30 3:19 auditd reports port number '0' for connect() system call Kangkook Jee
2016-03-30 23:29 ` Steve Grubb
2016-03-31 11:33 ` Kangkook Jee
2016-03-31 12:54 ` Kangkook Jee
2016-03-31 21:50 ` Steve Grubb
2016-03-31 22:11 ` Kangkook Jee
2016-04-01 12:13 ` Steve Grubb [this message]
2016-04-04 18:32 ` Kangkook Jee
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=18729284.EaRmKyajcD@x2 \
--to=sgrubb@redhat.com \
--cc=aixer77@gmail.com \
--cc=linux-audit@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox