SIGXCPU and Auditd

SIGXCPU and Auditd

[Paul Davies C]

[-- Attachment #1.1: Type: text/plain, Size: 329 bytes --]

Hi,

Is there any way to make the *auditd system to log the SIGXCPU signal*?
As of now , without writing any specific rules, SIGSEGV is getting 
logged. In my log I found lines as below :
/
type=ANOM_ABEND msg=audit(1383644379.989:88): auid=1000 uid=1000 
gid=1000 ses=5 pid=2688 comm="chrome" reason="memory violation" sig=11/


[-- Attachment #1.2: Type: text/html, Size: 582 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Re: SIGXCPU and Auditd

[Steve Grubb]

On Tuesday, November 05, 2013 06:39:04 PM Paul Davies C wrote:
> Hi,
> 
> Is there any way to make the *auditd system to log the SIGXCPU signal*?
> As of now , without writing any specific rules, SIGSEGV is getting
> logged. In my log I found lines as below :
> /
> type=ANOM_ABEND msg=audit(1383644379.989:88): auid=1000 uid=1000
> gid=1000 ses=5 pid=2688 comm="chrome" reason="memory violation" sig=11/

The ABnormal END event is triggered by any event that would be terminated by 
the kernel with a core dump. Looking at the signal(7) man page, SIGXCPU by 
default would core. So, it should trigger an event. I don't have a test case 
to prove it, though.

Steve

Re: SIGXCPU and Auditd

[Paul Davies C]

[-- Attachment #1.1: Type: text/plain, Size: 122 bytes --]

In the man page it is written that *core dump on SIGXCPU **can fail* . 
That is probably the reason why it is not logged.

[-- Attachment #1.2: Type: text/html, Size: 314 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Re: SIGXCPU and Auditd

[Steve Grubb]

On Tuesday, November 05, 2013 07:16:21 PM Paul Davies C wrote:
> In the man page it is written that *core dump on SIGXCPU **can fail* .
> That is probably the reason why it is not logged.

I think we would want the event even if the core dump failed. Maybe the hook 
placement needs review? Its probably been 5 years since it was put in the 
kernel...that's a lot of time for things to change.

-Steve

Re: SIGXCPU and Auditd

[Paul Davies C]

Audit system do logs the core dump signals. It was a misunderstanding 
from my part that lead me to believe that audit does not log SIGXCPU.

Sorry for the confusion.