From mboxrd@z Thu Jan 1 00:00:00 1970 From: Richard Guy Briggs Subject: Re: Early processes (daemons) do not report audit events Date: Sun, 13 Sep 2015 11:58:26 -0400 Message-ID: <20150913155826.GR8140@madcap2.tricolour.ca> References: <1E6087D5-E362-4795-BD8D-1374831498E4@gmail.com> <087AE25B-79B6-4E7A-BE4B-901BE95FB81B@gmail.com> <20150911095027.GO8140@madcap2.tricolour.ca> <8C676625-C8EF-4BDD-B5AA-4C2CC50B2BB0@gmail.com> <20150911162438.GQ8140@madcap2.tricolour.ca> <43B84A86-63BA-4573-9F12-5510E5E404DD@gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Return-path: Content-Disposition: inline In-Reply-To: <43B84A86-63BA-4573-9F12-5510E5E404DD@gmail.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Kangkook Jee Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com T24gMTUvMDkvMTEsIEthbmdrb29rIEplZSB3cm90ZToKPiBIaSBSaWNoYXJkLAoKSGkgS2FuZ2tv b2ssCgo+IEkgYWxzbyBkaWQgdGhlIHNhbWUgZXhwZXJpbWVudCBmb3IgdGhlIGxhdGVzdCBkaXN0 cmlidXRpb25zIG9mIEZlZG9yYQo+IGNvcmUgYW5kIERlYmlhbiBhbmQgaGVyZeKAmXMgdGhlIHJl c3VsdHMuCj4gCj4gRmVkb3JhLTIyICg2NC1iaXQsIDQuMC40LTMwMS5mYzIyLng4Nl82NCk6IFBy b2JsZW0gcmVwcm9kdWNlZC4KPiBEZWJpYW4tOCAoNjQtYml0LCAzLjE2LjAtNC1hbWQ2NCk6IFBy b2JsZW0gcmVwcm9kdWNlZAo+IAo+IEJ0dywgQnVybiBBbHRpbmcgKGJ1cm5Ac3d0Zi5keW5kbnMu b3JnKSBzdWdnZXN0ZWQgbWUgdG8gYXBwZW5kIGF1ZGl0PTEKPiB0byBrZXJuZWwgZmxhZy4gSSBh ZGRlZCB0aGUgb3B0aW9uIHRvIGJvb3QtbG9hZGVyIChncnViKSBhbmQgcHJvYmxlbQo+IHdlbnQg YXdheS4gCgpPbiBhbGwgc3lzdGVtcz8gIFRoaXMgaXMgZXhwZWN0ZWQgYmVoYXZpb3VyLiAgU29y cnkgSSB3YXMgbm90IG1vcmUKZXhwbGljaXQgaW4gYXNraW5nIHlvdSB0byB0ZXN0IHRoYXQuICBJ IGd1ZXNzIGl0IHdhcyBpbXBsaWVkIGJ5IGFza2luZwp3aGF0IHRoZSBzZXR0aW5ncyBmb3IgdGhl IGtlcm5lbCBjb21tYW5kIGxpbmUgd2VyZS4KCk5vdyB0aGUgc3VycHJpc2luZyBiaXQgaXMgdGhh dCBDZW50T1MgZG9lcyBub3QgZGVtb25zdHJhdGUgdGhlIHByb2JsZW0Kd2l0aG91dCBhdWRpdD0x IGluIHRoZSBjb21tYW5kIGxpbmUsIHdoaWNoIGxlYWRzIG1lIHRvIHdvbmRlciBpZiB0aGV5Cmhh dmUgc2V0ICJ1MzIgICAgICAgICAgICAgYXVkaXRfZW5hYmxlZCA9IDE7IiBhcm91bmQgbGluZSA4 MyBvZgprZXJuZWwvYXVkaXQuYyBpbiB0aGVpciBrZXJuZWwgc291cmNlLiAgSXQgd291bGQgc3Vy cHJpc2UgbWUgaWYgdGhleQpkaWQsIGJ1dCBpdCB3b3VsZCBub3QgYmUgY29tcGxldGVseSB1bnJl YXNvbmFibGUuCgo+IFJlZ2FyZHMsIEthbmdrb29rCj4gCj4gPiBPbiBTZXAgMTEsIDIwMTUsIGF0 IDEyOjI0IFBNLCBSaWNoYXJkIEd1eSBCcmlnZ3MgPHJnYkByZWRoYXQuY29tPiB3cm90ZToKPiA+ IE9uIDE1LzA5LzExLCBLYW5na29vayBKZWUgd3JvdGU6Cj4gPj4gRnJvbSB0aGUgcHJldmlvdXMg cmVwbHksIEkgdGhpbmsgSSBtaXN1bmRlcnN0b29kIHlvdXIgcXVlc3Rpb24gcmVnYXJkaW5nIGtl cm5lbCBjb21tYW5kIGxpbmUuIAo+ID4+IEhlcmXigJlzICJjYXQgL3Byb2MvY21kbGluZeKAnSBy ZXN1bHRzIGZvciBkaXN0cmlidXRpb25zIHRoYXQgSeKAmXZlIGV4cGVyaW1lbnRlZC4gCj4gPj4g Cj4gPj4gVWJ1bnR1IDE0LjA0ICg2NC1iaXQpOiAKPiA+PiAgICBCT09UX0lNQUdFPS9ib290L3Zt bGludXotMy4xMy4wLTU4LWdlbmVyaWMgcm9vdD1VVUlEPTc1MDVmODYyLWNlNDYtNDllNS05ZDFj LWU0ZTMwNzg0NDg4OSBybyB0ZXh0IHF1aWV0IHNwbGFzaCB2dC5oYW5kb2ZmPTcKPiA+PiAKPiA+ PiBVYnVudHUgMTIuMDQgKDY0LWJpdCk6IAo+ID4+ICAgIEJPT1RfSU1BR0U9L2Jvb3Qvdm1saW51 ei0zLjEzLjAtMzItZ2VuZXJpYyByb290PVVVSUQ9NWJlNzg5YmUtOWIwYy00NjNlLWJkMTgtNDJi ZmE3OWZiMjRjIHJvIHF1aWV0IHNwbGFzaAo+ID4+IAo+ID4+IENlbnRPUyA3ICg2NC1iaXQpOiAK PiA+PiAgICBCT09UX0lNQUdFPS92bWxpbnV6LTMuMTAuMC0yMjkuZWw3Lng4Nl82NCByb290PS9k ZXYvbWFwcGVyL2NlbnRvcy1yb290IHJvIHJkLmx2bS5sdj1jZW50b3Mvcm9vdCByZC5sdm0ubHY9 Y2VudG9zL3N3YXAgY3Jhc2hrZXJuZWw9YXV0byByaGdiIHF1aWV0IExBTkc9ZW5fVVMuVVRGLTgK PiA+PiAKPiA+PiBDZW50T1MgNiAoNjQtYml0KTogCj4gPj4gICAgcm8gcm9vdD1VVUlEPWE3ZDQ0 NTYwLWFkY2MtNDAwMC05NTg0LThiOWZjZjJhZmQ3NCByZF9OT19MVUtTIHJkX05PX0xWTSBMQU5H PWVuX1VTLlVURi04IHJkX05PX01EIFNZU0ZPTlQ9bGF0YXJjeXJoZWItc3VuMTYgY3Jhc2hrZXJu ZWw9MTI5TUAwTSAgS0VZQk9BUkRUWVBFPXBjIEtFWVRBQkxFPXVzIHJkX05PX0RNIHJoZ2IgcXVp ZXQKPiA+PiAKPiA+PiBJIGRvbuKAmXQgc2VlIGFueSBhdWRpdD08dmFsdWU+IGVudHJpZXMgZnJv bSBhbGwgZXhhbXBsZXMgYWJvdmUuIAo+ID4gCj4gPiBZZXMsIHRoaXMgaXMgd2hhdCBJIHdhcyBz ZWVraW5nIGZyb20geW91LiAgQW5kIHlvdSBhcmUgY29ycmVjdCwgbm9uZSBvZgo+ID4gdGhlbSBo YXZlIGF1ZGl0PTEgYXMgSSB3YXMgaG9waW5nIGZyb20gYXQgbGVhc3QgQ2VudE9TLiAgVGhlcmUg aXMgYQo+ID4gY2hhbmNlIHRoYXQgdGhlIENlbnRPUyBrZXJuZWwgd2FzIGNvbXBpbGVkIHdpdGgg YXVkaXQ9MSBoYXJkY29kZWQsIGJ1dCBJCj4gPiB0aGluayB0aGF0IGlzIGEgcHJldHR5IHNtYWxs IGNoYW5jZS4uLgo+ID4gCj4gPiBJJ2xsIGhhdmUgdG8gbG9vayBhdCB0aGlzIGNsb3Nlci4uLiAg QnV0IGFueSBEZWJpYW4gYW5kIEZlZG9yYSBkYXRhCj4gPiBwb2ludHMgdGhhdCB5b3UgY2FuIHBy b3ZpZGUgd291bGQgY2VydGFpbmx5IGJlIHVzZWZ1bC4KPiA+IAo+ID4+IC9LYW5na29vawo+ID4+ IAo+ID4+PiBPbiBTZXAgMTEsIDIwMTUsIGF0IDU6NTAgQU0sIFJpY2hhcmQgR3V5IEJyaWdncyA8 cmdiQHJlZGhhdC5jb20+IHdyb3RlOgo+ID4+PiAKPiA+Pj4gT24gMTUvMDkvMTAsIEthbmdrb29r IEplZSB3cm90ZToKPiA+Pj4+IEhpIGFsbCwKPiA+Pj4+IAo+ID4+Pj4gSSBkZWJ1Z2dlZCBhIGJp dCBmdXJ0aGVyIHRvIGlkZW50aWZ5IGRpc3RyaWJ1dGlvbnMgdGhhdCBhcmUgYWZmZWN0ZWQgYnkg dGhlIGlzc3VlLgo+ID4+Pj4gSSByZXBlYXRlZCB0aGUgc2FtZSBleHBlcmltZW50IHdpdGggc3No ZCBmcm9tIDMgbW9yZSBkaXN0cmlidXRpb25zLgo+ID4+Pj4gCj4gPj4+PiBDZW50T1MgTGludXgg cmVsZWFzZSA3LjEuMTUwMyAoNjQtYml0LCAzLjEwLjAtMjI5LmVsNy54ODZfNjQpOiBQcm9ibGVt IE5PVCByZXByb2R1Y2VkCj4gPj4+PiBDZW50T1MgcmVsZWFzZSA2LjYgKDY0LWJpdCwgMi42LjMy LTUwNC5lbDYueDg2XzY0KTogUHJvYmxlbSBOT1QgcmVwcm9kdWNlZAo+ID4+Pj4gVWJ1bnR1IDEy LjA0LjUgTFRTICg2NC1iaXQsIDMuMTMuMC0zMi1nZW5lcmljKTogUHJvYmxlbSByZXByb2R1Y2Vk Cj4gPj4+IAo+ID4+PiBGb3IgZWFjaCBvZiB0aGVzZSBleGFtcGxlcywgd2hhdCBpcyB0aGUgdmFs dWUgb2YgdGhlIGtlcm5lbCBjb21tYW5kIGxpbmUKPiA+Pj4gImF1ZGl0PTx2YWx1ZT4iIGlmIGl0 IGlzIGV2ZW4gcHJlc2VudD8gIEl0IGlzIHBvc3NpYmxlIHRoYXQgdGhlIENlbnRPUwo+ID4+PiBl eGFtcGxlcyBpbmNsdWRlICJhdWRpdD0xIiB3aGlsZSBVYnVudHUgb21pdHMgdGhlIGxpbmUuICAi Y2F0Cj4gPj4+IC9wcm9jL2NtZGxpbmUiIHNob3VsZCB0ZWxsIHlvdSB0aGUgYW5zd2VyLgo+ID4+ PiAKPiA+Pj4+IEFmdGVyIGFsbCwgVWJ1bnR1IGZhbWlseSBhcmUgYWZmZWN0ZWQgYnkgdGhlIGlz c3VlIGFuZCBJIGNvdWxkIGNvbmZpcm0KPiA+Pj4+IHRoYXQgcmVzdWx0cyBhcmUgaW5jb25zaXN0 ZW50IGFjcm9zcyB0d28gZGlmZmVyZW50IGRpc3RyaWJ1dGlvbgo+ID4+Pj4gZmFtaWxpZXMuIAo+ ID4+PiAKPiA+Pj4gSSB3b3VsZCBiZSBjdXJpb3VzIHdoYXQgeW91ciByZXN1bHRzIGFyZSB3aXRo IGEgcmVjZW50IERlYmlhbiBhbmQgd2l0aCBhCj4gPj4+IHJlY2VudCBGZWRvcmEuCj4gPj4+IAo+ ID4+Pj4gSWYgeW91IGNhbiBsZXQgdXMga25vdyBob3cgY2FuIHdlIHdvcmthcm91bmQgdGhlIGlz c3VlLCBpdCB3aWxsIGJlIGEgZ3JlYXQgaGVscC4KPiA+Pj4+IAo+ID4+Pj4gUmVnYXJkcywgS2Fu Z2tvb2sKPiA+Pj4+IAo+ID4+Pj4gCj4gPj4+Pj4gT24gU2VwIDksIDIwMTUsIGF0IDExOjUwIFBN LCBLYW5na29vayBKZWUgPGFpeGVyNzdAZ21haWwuY29tPiB3cm90ZToKPiA+Pj4+PiAKPiA+Pj4+ PiBEZWFyIGFsbCwKPiA+Pj4+PiAKPiA+Pj4+PiBXZSBhcmUgZGV2ZWxvcGluZyBjdXN0b20gdXNl ciBzcGFjZSBhdWRpdCBhZ2VudCB0byBnYXRoZXIgc3lzdGVtIHdpZGUgc3lzdGVtCj4gPj4+Pj4g Y2FsbCB0cmFjZS4gV2hpbGUgZXhwZXJpbWVudGluZyB3aXRoIHZhcmlvdXMgcHJvZ3JhbXMsIHdl IGZvdW5kIG91dCB0aGF0Cj4gPj4+Pj4gcHJvY2Vzc2VzIChkYWVtb25zKSB0aGF0IHN0YXJ0ZWQg ZWFybHkgKGFsb25nIHdpdGggdGhlIHN5c3RlbSBib290c3RyYXBwaW5nKSBkbwo+ID4+Pj4+IG5v dCByZXBvcnQgYW55IGF1ZGl0IGV2ZW50cyBhdCBhbGwuIFRoZXNlIHByb2Nlc3NlcyB0eXBpY2Fs bHkgZmFsbCBpbnRvIFBJRAo+ID4+Pj4+IHJhbmdlIG9mIGxlc3MgdGhhbiAyMDAwLiBIZXJl4oCZ cyBob3cgSSByZXByb2R1Y2VkIHRoZSBzeW1wdG9tIHdpdGggc3NoZCBkYWVtb24uCj4gPj4+Pj4g Cj4gPj4+Pj4gMS4gUmVib290IHRoZSBzeXN0ZW0KPiA+Pj4+PiAKPiA+Pj4+PiAyLiBBZGQgYW5k IGVuYWJsZSBhdWRpdCBldmVudHMKPiA+Pj4+PiAgIyAvc2Jpbi9hdWRpdGN0bCAtYSBleGl0LGFs d2F5cyAtRiBhcmNoPWI2NCAtUyBjbG9uZSAtUyBjbG9zZSAtUyBjcmVhdCAtUyBkdXAKPiA+Pj4+ PiAgICAgICAgIC1TIGR1cDIgLVMgZHVwMyAtUyBleGVjdmUgLVMgZXhpdCAtUyBleGl0X2dyb3Vw IC1TIGZvcmsgLVMgb3BlbiAtUyBvcGVuYXQgCj4gPj4+Pj4gICAgICAgICAtUyB1bmxpbmsgLVMg dW5saW5rYXQgLVMgdmZvcmsgLVMgMjg4IC1TIGFjY2VwdCAtUyBiaW5kIC1TIGNvbm5lY3QgCj4g Pj4+Pj4gICAgICAgICAtUyBsaXN0ZW4gLVMgc29ja2V0IC1TIHNvY2tldHBhaXIKPiA+Pj4+PiAg IyAvc2Jpbi9hdWRpdGN0bCAtZTEgLWIgMTAyNDAwCj4gPj4+Pj4gCj4gPj4+Pj4gMy4gQ29ubmVj dCB0byB0aGUgc3lzdGVtIHZpYSBzc2gKPiA+Pj4+PiAgIEF1ZGl0IG1lc3NhZ2VzIGdlbmVyYXRl ZCBvbmx5IGZyb20gY2hpbGQgcHJvY2Vzc2VzIGFuZCBub25lIGFyZSBzZWVuIGZyb20KPiA+Pj4+ PiAgIHRoZSBvcmlnaW5hbCBkYWVtb24uCj4gPj4+Pj4gCj4gPj4+Pj4gNC4gUmVzdGFydCBzc2hk IAo+ID4+Pj4+ICAgIyByZXN0YXJ0IHNzaAo+ID4+Pj4+IAo+ID4+Pj4+IDUuIENvbm5lY3QgYWdh aW4gdG8gdGhlIHN5c3RlbSB2aWEgc3NoCj4gPj4+Pj4gIE5vdywgd2Ugc2VlIGF1ZGl0IG1lc3Nh Z2VzIGZyb20gYm90aCBwYXJlbnQgYW5kIGNoaWxkIHByb2Nlc3Nlcy4KPiA+Pj4+PiAKPiA+Pj4+ PiBJIGRpZCB0aGUgZXhwZXJpbWVudCBmcm9tIFVidW50dSAxNC4wNC4yIExUUyBkaXN0cmlidXRp b24gKDY0LWJpdCwga2VybmVsCj4gPj4+Pj4gdmVyc2lvbiAzLjEzLjAtNTgtZ2VuZXJpYykuCj4g Pj4+Pj4gCj4gPj4+Pj4gSSBmaXJzdCB3b25kZXIgd2hldGhlciB0aGlzIGlzIGludGVuZGVkIGJl aGF2aW9yIG9mIGF1ZGl0IGZyYW1ld29yayBvcgo+ID4+Pj4+IG5vdC4gSWYgaXQgaXMgaW50ZW5k ZWQsIEkgYWxzbyB3YW50IHRvIGtub3cgaG93IGNhbiB3ZSBjb25maWd1cmUgYXVkaXRkCj4gPj4+ Pj4gZGlmZmVyZW50bHkgdG8gY2FwdHVyZSBzeXN0ZW0gY2FsbHMgZnJvbSBhbGwgcHJvY2Vzc2Vz LiAKPiA+Pj4+PiAKPiA+Pj4+PiBUaGFua3MgYSBsb3QgZm9yIHlvdXIgaGVscCBpbiBhZHZhbmNl IQo+ID4+Pj4+IAo+ID4+Pj4+IFJlZ2FyZHMsIEthbmdrb29rCj4gPj4+IAo+ID4+PiAtIFJHQgo+ ID4gCj4gPiAtIFJHQgoKLSBSR0IKCi0tClJpY2hhcmQgR3V5IEJyaWdncyA8cmJyaWdnc0ByZWRo YXQuY29tPgpTZW5pb3IgU29mdHdhcmUgRW5naW5lZXIsIEtlcm5lbCBTZWN1cml0eSwgQU1FUiBF TkcgQmFzZSBPcGVyYXRpbmcgU3lzdGVtcywgUmVkIEhhdApSZW1vdGUsIE90dGF3YSwgQ2FuYWRh ClZvaWNlOiArMS42NDcuNzc3LjI2MzUsIEludGVybmFsOiAoODEpIDMyNjM1LCBBbHQ6ICsxLjYx My42OTMuMDY4NHgzNTQ1CgotLQpMaW51eC1hdWRpdCBtYWlsaW5nIGxpc3QKTGludXgtYXVkaXRA cmVkaGF0LmNvbQpodHRwczovL3d3dy5yZWRoYXQuY29tL21haWxtYW4vbGlzdGluZm8vbGludXgt YXVkaXQ=