From: Steve Grubb <sgrubb@redhat.com>
To: linux-audit@redhat.com
Cc: Jan <jan.hadewig@email.de>
Subject: Re: Linux Audit Framework question
Date: Mon, 25 Jun 2012 08:01:47 -0400 [thread overview]
Message-ID: <2042886.1uMvLIOJ4t@x2> (raw)
In-Reply-To: <97579BF8-E7F6-4706-83AB-98A3DC8B944B@email.de>
On Wednesday, June 20, 2012 01:04:26 PM Jan wrote:
> Hello,
>
> I write you because i do not know how to go further without solving my
> problem. When a user switches from username to root using sudo su - this
> action is audited by LAF but since that change the user-id in the LAF
> logfile is 0 for root user. If my user uses chmod afterwords to change file
> permissions i can not see which user did the change because user-id is 0
> and the auditid is always 4294967295. Can you tell me how it is possible to
> trace the user after switching to root ??
Its sounds like your entry point is missing the following pam line:
session required pam_loginuid.so
This sets the loginuid which is inherited by each process the user creates.
So, if they get in by gdm, it needs to be in gdm's pam stack. If they get in
by sshd, it needs to be there. Etc.
-Steve
prev parent reply other threads:[~2012-06-25 12:01 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-06-20 11:04 Linux Audit Framework question Jan
2012-06-25 12:01 ` Steve Grubb [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2042886.1uMvLIOJ4t@x2 \
--to=sgrubb@redhat.com \
--cc=jan.hadewig@email.de \
--cc=linux-audit@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox