Re: audit 1.2.2 released

[Michael C Thompson <thompsmc@us.ibm.com>]

Steve Grubb wrote:
> Hi,
> 
> I've just released a new version of the audit daemon. It can be downloaded 
> from http://people.redhat.com/sgrubb/audit  It will also be in rawhide  
> tomorrow. The Changelog is:
> 
> - Updates for new glibc-kernheaders
> - Change auditctl to collect list of rules then delete them on -D
> - Update capp.rules and lspp.rules to comment out rules for the possible list
> - Add new message types
> - Support sigusr1 sender identity of newer kernels
> - Add support for ppid in auditctl and ausearch
> - fix auditctl to trim the '/' from watches
> - Move audit daemon config files to /etc/audit for better SE Linux protection
> 
> Beware !  This release has 2 changes to notice. It requires newer 
> glibc-kernheaders and it moves the audit configuration files to 
> the /etc/audit directory. The specfile should handle the transition 
> gracefully.
> 
> This release also supports new options in our current development kernels. It 
> adds support for filtering by ppid and searching for ppid in the logs. It 
> supports getting the signal info for senders of sigusr1. And completes the 
> fix for listing or deleting large amounts of syscall rules. Watches that have 
> a trailing '/' will now have it trimmed to make the kernel happier.
> 
> 2 new message types were added AUDIT_DEV_ALLOC and AUDIT_DEV_DEALLOC for LSPP 
> work. The capp & lspp rules were updated to not have "possible" as the list 
> action.
> 
> Please let me know if there are any problems with this release.

With the current version of audit, auditctl -l only prints an equal, not 
equal operator when it displays rules, while the rules in the kernel are 
operating correctly, this is most an inconvenience, since is not 
possible to tell what rules are really in the kernel.

The problem lies in the audit_print_reply logic not detecting the type 
of the message (either AUDIT_LIST or AUDIT_LIST_RULE).

Below is a patch which adds this detection.

Thanks,
Mike

----

Signed-off-by: Michael Thompson <mcthomps@us.ibm.com>

--- audit-1.2.2-orig/src/auditctl.c	2006-05-12 14:59:59.000000000 -0500
+++ audit-1.2.2/src/auditctl.c	2006-05-16 15:56:31.000000000 -0500
@@ -926,8 +926,14 @@ static int audit_print_reply(struct audi
  			for (i = 0; i < rep->rule->field_count; i++) {
  				int field = rep->rule->fields[i] &
  					~AUDIT_OPERATORS & ~AUDIT_NEGATE;
-				int op = rep->rule->fields[i] &
-					(AUDIT_OPERATORS | AUDIT_NEGATE);
+				int op;
+				if (rep->type == AUDIT_LIST_RULES) {
+					op = rep->ruledata->fieldflags[i] &
+						(AUDIT_OPERATORS | AUDIT_NEGATE);
+				} else {
+					op = rep->rule->fields[i] &
+						(AUDIT_OPERATORS | AUDIT_NEGATE);
+				}

  				const char *name = audit_field_to_name(field);
  				if (name) {