Re: Writting to audit with an application

[Steve Grubb <sgrubb@redhat.com>]

On Saturday 17 March 2007 17:34:57 geckiv wrote:
>  Thanks for the reply.  I must have something wrong  with my system as I
> can't get it to work even running it as root. I get an error of:
>
> FAILURE:  errno = 22
> Error writing audit file: Invalid argument
> Error writing audit: Illegal seek

This does sound wrong. Maybe strace would shed some light on how its going 
wrong? What kernel are you using?

> Also how do I set auditd to allow other process(s) running not as root
> to write to the netlink/kernel ( i.e. set CAP_AUDIT_WRITE)?

You can't. The audit system is designed to be high integrity meaning only 
trusted apps or processes that run as root or started as root but dropped 
privileges keeping CAP_AUDIT_WRITE. The audit event is written to the kernel, 
not auditd (meaning the kernel must be compiled with syscall audit support at 
a minimum). The kernel may decide to give the event to auditd.

> I could not find any info on this.  Also where do I find these trusted app
> examples?

dbus, nscd, passwd, shadow-utils, pam, ...

> Is this something I down loa the src of Linux and look for?

No, dbus is an example of a program that keeps CAP_AUDIT_WRITE after starting 
as root but changes uids. passwd is setuid root. pam runs as part of 
applications that stay root.

-Steve