Re: auditd and CAP_AUDIT_READ

[Steve Grubb <sgrubb@redhat.com>]

On Thu, 15 Nov 2018 08:23:46 -0500
Richard Guy Briggs <rgb@redhat.com> wrote:

> > I thought that the prime audit connection requires a capability
> > check to ensure a process without proper privilege does not replace
> > the audit daemon...since that's now possible. Are there privilege
> > checks for who can connect to the audit socket? Shouldn't that
> > process also have CAP_AUDIT_READ since that is what it will be
> > doing?  
> 
> The only cap that will let a daemon be checked for replacement is
> CAP_AUDIT_CONTROL.  CAP_AUDIT_READ is only used for the unreliable
> reception of multicast audit log records.
> 
> The unicast socket is gated by CAP_AUDIT_CONTROL and CAP_AUDIT_WRITE.
> The multicast read-only unreliable socket is gated by
> CAP_AUDIT_READ.

My understanding was that CAP_AUDIT_READ was required by everything
that read, including unicast. That is why it checks that capability
CAP_AUDIT_READ. Shouldn't everything reading need that capability?

-Steve