From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: Auditing failed kill events Date: Tue, 21 Aug 2007 11:50:45 -0400 Message-ID: <200708211150.46895.sgrubb@redhat.com> References: <6F2A8C9C4C5BE446A17B745BBC856EEB5A6D37@XMBTX113.northgrum.com> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <6F2A8C9C4C5BE446A17B745BBC856EEB5A6D37@XMBTX113.northgrum.com> Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Tuesday 21 August 2007 11:13:35 Henning, Arthur C. (CSL) wrote: > RHEL kernel 2.6.18-8.el5xen This was the GA kernel which had an omission in several things for audit. > Audit 1.5.6-1.i386 That's on RHEL? > Get log entry of the failed attempt > # ausearch -i -sv no > type=SYSCALL msg=audit(08/21/2007 09:40:36.832:1458) : arch=i386 > syscall=kill success=no exit=-1(Operation not permitted) a0=f8c a1=9 > a2=f8c a3=f8c items=0 ppid=3391 pid=3402 auid=art uid=art gid=art > euid=art suid=art fsuid=art egid=art sgid=art fsgid=art tty=pts2 > comm=bash exe=/bin/bash subj=user_u:system_r:unconfined_t:s0 key=(null) You should have a OBJ_PID record, too. > Is there a way to indentify the process which the user attempted to > kill? Yes, the OBJ_PID record looks like this: type=OBJ_PID msg=audit(08/21/2007 11:42:36.556:490) : opid=1709 obj=system_u:system_r:auditd_t:s0 > Or by whom the process is owned? What is logged is the object ID that kill is acting upon. Which I suppose does not help in CAPP situations (and I don't think it was required by CAPP). -Steve