From mboxrd@z Thu Jan 1 00:00:00 1970 From: Michael C Thompson Subject: Re: audit 1.2.2 released Date: Tue, 16 May 2006 09:53:07 -0500 Message-ID: <4469E753.3070206@us.ibm.com> References: <200605121726.32952.sgrubb@redhat.com> <4468DD20.8020600@us.ibm.com> <200605151604.51642.sgrubb@redhat.com> <4468E115.40107@us.ibm.com> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <4468E115.40107@us.ibm.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Michael C Thompson Cc: Linux Audit List-Id: linux-audit@redhat.com Michael C Thompson wrote: > Steve Grubb wrote: >> On Monday 15 May 2006 15:57, Michael C Thompson wrote: >>> auditctl is still reporting the "error sending rule" problem. Here are >>> my auditctl and kernel versions: >>> >>> auditctl version 1.2.2 >>> 2.6.16-1.2200.2.2_FC6.lspp.25 >>> >>> # auditctl -l >>> Error sending rule list request (Operation not permitted) >> >> This is not the error sending rule problem. This looks like a >> permission problem. What selinux policy and role are you doing this >> from? Are there any relevant AVCs in the audit logs from this time? >> >> -Steve > I've "enchanced" this transcript with strace output (selective) and the return code of the selinux_socket_recvmsg call. > This is a transcript from Permissive mode, with role being staff_r. I do > not see the "Error sending rule list request (Operation not permitted)" > when SELinux is disabled (selinux=0) or when as auditadm_r at SystemHigh. > > # auditctl -l sendto(3, "\20\0\0\0\365\3\5\0\1\0\0\0\0\0\0\0", 16, 0, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 16 poll([{fd=3, events=POLLIN, revents=POLLIN}], 1, 100) = 1 recvfrom(3, "$\0\0\0\2\0\0\0\1\0\0\0\322\7\0\0\377\377\377\377\20\0"..., 8476, MSG_PEEK|MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 36 -> selinux_sock_recvmsg returns 0 recvfrom(3, "$\0\0\0\2\0\0\0\1\0\0\0\322\7\0\0\377\377\377\377\20\0"..., 8476, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 36 -> selinux_sock_recvmsg returns 0 write(2, "Error sending rule list request "..., 57Error sending rule list request (Operation not permitted)) = 57 > Error sending rule list request (Operation not permitted) > [ resulting log activity: > type=AVC msg=audit(1147657744.953:39): avc: denied { nlmsg_readpriv } > for pid=2091 comm="auditctl" > scontext=root:staff_r:staff_t:s0-s15:c0.c255 > tcontext=root:staff_r:staff_t:s0-s15:c0.c255 tclass=netlink_audit_socket > type=SYSCALL msg=audit(1147657744.953:39): arch=40000003 syscall=102 > success=yes exit=16 a0=b a1=bfad2760 a2=805b0f8 a3=10 items=0 ppid=2067 > pid=2091 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 > tty=pts1 comm="auditctl" exe="/sbin/auditctl" > subj=root:staff_r:staff_t:s0-s15:c0.c255 > type=SOCKADDR msg=audit(1147657744.953:39): saddr=100000000000000000000000 > type=SOCKETCALL msg=audit(1147657744.953:39): nargs=6 a0=3 a1=bfad69fc > a2=10 a3=0 a4=bfad2790 a5=c > ] > > # auditctl -l sendto(3, "\20\0\0\0\365\3\5\0\1\0\0\0\0\0\0\0", 16, 0, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 16 poll([{fd=3, events=POLLIN, revents=POLLIN}], 1, 100) = 1 recvfrom(3, "$\0\0\0\2\0\0\0\1\0\0\0\326\7\0\0\0\0\0\0\20\0\0\0\365"..., 8476, MSG_PEEK|MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 36 -> selinux_sock_recvmsg returns 0 recvfrom(3, "$\0\0\0\2\0\0\0\1\0\0\0\326\7\0\0\0\0\0\0\20\0\0\0\365"..., 8476, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 36 -> selinux_sock_recvmsg returns 0 select(4, [3], NULL, NULL, {0, 100000}) = 1 (in [3], left {0, 100000}) recvfrom(3, "\20\0\0\0\3\0\2\0\1\0\0\0\326\7\0\0", 8476, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 16 -> selinux_sock_recvmsg returns 0 > No rules > [ no log activity ] I do not know enough of about the auditctl code, but to me this looks like auditctl is failing to issue the 3rd recvfrom syscall. As a side note, auditctl is somehow executable by staff_t, but staff_t can send to the netlink socket (although staff_t can estabish one). Thanks, Mike