Re: Writting to audit with an application

[geckiv <geckiv@optonline.net>]

[-- Attachment #1.1: Type: text/plain, Size: 1587 bytes --]


Steve,
    I never heard of dbus before. Is there an example how it keeps it's  
CAP_AUDIT_WRITE and changes uids? Is this just using setuid() some how?

Thanks,

Frank

Steve Grubb wrote:

>On Saturday 17 March 2007 17:34:57 geckiv wrote:
>  
>
>> Thanks for the reply.  I must have something wrong  with my system as I
>>can't get it to work even running it as root. I get an error of:
>>
>>FAILURE:  errno = 22
>>Error writing audit file: Invalid argument
>>Error writing audit: Illegal seek
>>    
>>
>
>This does sound wrong. Maybe strace would shed some light on how its going 
>wrong? What kernel are you using?
>
>  
>
>>Also how do I set auditd to allow other process(s) running not as root
>>to write to the netlink/kernel ( i.e. set CAP_AUDIT_WRITE)?
>>    
>>
>
>You can't. The audit system is designed to be high integrity meaning only 
>trusted apps or processes that run as root or started as root but dropped 
>privileges keeping CAP_AUDIT_WRITE. The audit event is written to the kernel, 
>not auditd (meaning the kernel must be compiled with syscall audit support at 
>a minimum). The kernel may decide to give the event to auditd.
>
>  
>
>>I could not find any info on this.  Also where do I find these trusted app
>>examples?
>>    
>>
>
>dbus, nscd, passwd, shadow-utils, pam, ...
>
>  
>
>>Is this something I down loa the src of Linux and look for?
>>    
>>
>
>No, dbus is an example of a program that keeps CAP_AUDIT_WRITE after starting 
>as root but changes uids. passwd is setuid root. pam runs as part of 
>applications that stay root.
>
>-Steve
>
>
>  
>

[-- Attachment #1.2: Type: text/html, Size: 2335 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]