init and its direct children not audited?

init and its direct children not audited?

[Matthew Booth]

[-- Attachment #1.1: Type: text/plain, Size: 1276 bytes --]

I have the following in my test audit configuration on RHEL4 U5:

-a entry,always -S exit -S exit_group -S execve -S fork -S vfork -S
clone

My first observation is that I've never seen an audit record with pid=1.
It's fairly easy to reproduce this one. Log in at the console, then log
out. You'll see a process execve() a new mingetty, but you won't see the
fork, vfork or clone which created it.

My second observation is a bit more complex. I have a box running Oracle
RAC. RAC runs some particularly nasty scripts on a regular basis (once
per second). In outline, it does this:

In inittab:
respawn:init.cssd

In init.cssd:
while true; do
    init.cssd runcheck
done

I see that a process execs 'init.cssd runcheck' once per second.
However, I do not see a process fork, vfork or clone that process. This
suggests that audit data isn't being produced for the top level
init.cssd job.

Does this ring any bells? Is there some other method of process creation
I'm not aware of? Is init intentionally not audited, and if so, how do I
audit it?

Thanks,

Matt
-- 
Matthew Booth, RHCA, RHCSS
Red Hat, Global Professional Services

M:       +44 (0)7977 267231
GPG ID:  D33C3490
GPG FPR: 3733 612D 2D05 5458 8A8A 1600 3441 EA19 D33C 3490

[-- Attachment #1.2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Re: init and its direct children not audited?

[Steve Grubb]

On Wednesday 15 August 2007 10:51:21 Matthew Booth wrote:
> Does this ring any bells?

Yes.

> Is there some other method of process creation I'm not aware of? Is init
> intentionally not audited, and if so, how do I audit it?

You must have the audit=1 boot parameter to audit any process that is created 
before auditd runs. This is in the man page under NOTES.

-Steve