From: Steve Grubb <sgrubb@redhat.com>
To: linux-audit@redhat.com
Cc: Konrad Witaszczyk <def@freebsd.org>
Subject: Re: The res field has a value of 1 instead of either success or fail
Date: Wed, 20 Jul 2016 09:17:49 -0400 [thread overview]
Message-ID: <3334207.ycjxCksCQn@x2> (raw)
In-Reply-To: <68967373-F5EC-4790-B7F0-DFD35220B0A8@FreeBSD.org>
On Wednesday, July 20, 2016 11:25:19 AM EDT Mateusz Piotrowski wrote:
> Hello,
>
> > On 19 Jul 2016, at 12:28, Mateusz Piotrowski <0mp@freebsd.org> wrote:
> >
> > type=CONFIG_CHANGE msg=audit(1464013671.541:406): auid=1000 ses=7 op="add
> > rule" key=(null) list=4 res=1 As you can see, there is a res field which
> > value is 1.
> >
> > Is it because my auditd is outdated? Is there a missing res field which is
> > purely numeric (just like the fields called fp [3])?
No. There is inconsistency because different people do it their way without
regard for anyone who is trying to make sense of the audit trail. This is why
I have published so many specifications. I want to point to the docs and say
you have to conform. And this is also why I want to write a validation suite.
We need to find all the outliers and fix them.
-Steve
> > As Steve said in previous emails, it is possible and it might be fixed
> > already. I’ll try to find out if I get similar logs with the latest
> > auditd (2.6.5) on CentOS 6.8-i386 later.
>
> I confirm that it is possible to generate a type=CONFIG_CHANGE record with a
> res=1 field on CentOS 6.8 with auditd v2.6.5.
>
> Cheers
>
> -m
>
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit
--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit
prev parent reply other threads:[~2016-07-20 13:17 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-07-19 10:28 The res field has a value of 1 instead of either success or fail Mateusz Piotrowski
2016-07-20 9:25 ` Mateusz Piotrowski
2016-07-20 13:17 ` Steve Grubb [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3334207.ycjxCksCQn@x2 \
--to=sgrubb@redhat.com \
--cc=def@freebsd.org \
--cc=linux-audit@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox