From mboxrd@z Thu Jan 1 00:00:00 1970 From: Kangkook Jee Subject: Re: Question regarding audit message interpretation Date: Wed, 14 Jan 2015 10:26:32 -0500 Message-ID: <5B17F964-BE7B-4F9B-9440-5CA806C7B431@gmail.com> References: <1F946D4D-C67C-4A15-ABAF-6583480F636C@gmail.com> <20150114143030.GL29998@madcap2.tricolour.ca> Mime-Version: 1.0 (Mac OS X Mail 8.1 \(1993\)) Content-Type: multipart/mixed; boundary="===============0846394768021956728==" Return-path: In-Reply-To: <20150114143030.GL29998@madcap2.tricolour.ca> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Richard Guy Briggs Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com --===============0846394768021956728== Content-Type: multipart/alternative; boundary="Apple-Mail=_50B078FD-FF20-45F3-8757-B3CDCDC47597" --Apple-Mail=_50B078FD-FF20-45F3-8757-B3CDCDC47597 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Dear Richard Thanks a lot for your prompt reply.=20 According to your email and patches that you provided, CASE 2 is = regarded as a clear error case.=20 Then, How about CASE 1? Is this an error case or an intended behavior?=20= If it is an error case, I assume we need to use the last item (in this = case 'item=3D1=E2=80=99) for the open path.=20 If not, what is the reason to have two items and what does each stand = for? Thanks again for your help in advance. /Kangkook > On Jan 14, 2015, at 9:30 AM, Richard Guy Briggs = wrote: >=20 > On 15/01/14, Kangkook Jee wrote: >> Hi, all >=20 > Hi Kangkook, >=20 >> I have a question regarding how to interpret the audit message that = we got for >> an open system call. In most cases, we observe a single item (path) = information >> followed by 'syscall' and 'cwd' messages. However, in some cases, we = see 2 or 3 >> items (paths) followed by 'syscall' and 'cwd' messages like following = cases. >>=20 >> CASE 1: >>=20 >> Jan 14 11:00:01 hostname kernel: [4980285.399982] type=3D1300 = audit(1421233201.056:893730395): arch=3Dc000003e syscall=3D2 success=3Dyes= exit=3D5 a0=3D7ffff4ae5830 a1=3Dc2 a2=3D180 a3=3D2233546f14d99 items=3D2 = ppid=3D983 pid=3D5723 auid=3D4294967295 uid=3D0 gid=3D0 euid=3D0 suid=3D0 = fsuid=3D0 egid=3D0 sgid=3D0 fsgid=3D0 ses=3D4294967295 tty=3D(none) = comm=3D"cron" exe=3D"/usr/sbin/cron" key=3D(null) >> Jan 14 11:00:01 hostname kernel: [4980285.399985] type=3D1307 = audit(1421233201.056:893730395): cwd=3D"/var/spool/cron" >> Jan 14 11:00:01 hostname kernel: [4980285.399988] type=3D1302 = audit(1421233201.056:893730395): item=3D0 name=3D"/tmp/" inode=3D40961 = dev=3Dca:01 mode=3D041777 ouid=3D0 ogid=3D0 rdev=3D00:00 >> Jan 14 11:00:01 hostname kernel: [4980285.399990] type=3D1302 = audit(1421233201.056:893730395): item=3D1 name=3D"/tmp/tmpfS9woiP" = inode=3D30733 dev=3Dca:01 mode=3D0100600 ouid=3D0 ogid=3D0 rdev=3D00:00 >>=20 >> CASE 2: >>=20 >> Jan 14 11:19:37 hostname kernel: [4981461.529450] type=3D1300 = audit(1421234377.184:894228556): arch=3Dc000003e syscall=3D2 success=3Dyes= exit=3D5 a0=3Dfa9700 a1=3D441 a2=3D1b6 a3=3D0 items=3D3 ppid=3D5727 = pid=3D5728 auid=3D4294967295 uid=3D1000 gid=3D1000 euid=3D1000 suid=3D1000= fsuid=3D1000 egid=3D1000 sgid=3D1000 fsgid=3D1000 ses=3D4294967295 = tty=3D(none) comm=3D"Run" exe=3D"/usr/bin/perl" key=3D(null) >> Jan 14 11:19:37 hostname kernel: [4981461.529454] type=3D1307 = audit(1421234377.184:894228556): = cwd=3D"/home/ubuntu/benchmarks/UnixBench/testdir" >> Jan 14 11:19:37 hostname kernel: [4981461.529458] type=3D1302 = audit(1421234377.184:894228556): item=3D0 = name=3D"/home/ubuntu/benchmarks/UnixBench/results/" inode=3D396144 = dev=3Dca:01 mode=3D040775 ouid=3D1000 ogid=3D1000 rdev=3D00:00 >> Jan 14 11:19:37 hostname kernel: [4981461.529460] type=3D1302 = audit(1421234377.184:894228556): item=3D1 name=3D(null) inode=3D440344 = dev=3Dca:01 mode=3D0100664 ouid=3D1000 ogid=3D1000 rdev=3D00:00 >> Jan 14 11:19:37 hostname kernel: [4981461.529463] type=3D1302 = audit(1421234377.184:894228556): item=3D2 name=3D(null) inode=3D440344 = dev=3Dca:01 mode=3D0100664 ouid=3D1000 ogid=3D1000 rdev=3D00:00 >>=20 >> I investigated audit source code a bit and found out that these are = produced as >> a result of enumerations over audit_context.names_list data = structure. But, I'm >> still not clear how and when entries for this data structure are = filled. >=20 > There has been active work done recently to fix this problem. Your = case > #2 is clearly an example of what we've been seeing. >=20 > Paul Moore sent a patch in early December and another at the end of > December, followed by a patchset from January 8th in an attempt to = clean > things up for good: > = https://www.redhat.com/archives/linux-audit/2014-December/msg00001.html = > audit: correctly record file names with different path = name types > = https://www.redhat.com/archives/linux-audit/2014-December/msg00108.html = > audit: create private file name copies when auditing = inodes > = https://www.redhat.com/archives/linux-audit/2015-January/msg00016.html = > "Overhaul the audit filename handling" >=20 > See also: > https://bugzilla.redhat.com/show_bug.cgi?id=3D1155208 = >=20 >> Could anyone explain what would it mean to have multiple items = (paths) means for >> a single open syscall invocation? >=20 > Usually directory and file. >=20 >> Thanks a lot for your help in advance.=20 >>=20 >> Regards, Kangkook >=20 > - RGB >=20 > -- > Richard Guy Briggs > > Senior Software Engineer, Kernel Security, AMER ENG Base Operating = Systems, Red Hat > Remote, Ottawa, Canada > Voice: +1.647.777.2635, Internal: (81) 32635, Alt: = +1.613.693.0684x3545 --Apple-Mail=_50B078FD-FF20-45F3-8757-B3CDCDC47597 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Dear Richard

Thanks a lot for your prompt reply. 
According to your email and patches that you provided, CASE 2 = is regarded as a clear error case. 

Then, How about CASE 1? Is this an = error case or an intended behavior? 
If it is = an error case, I assume we need to use the last item (in this case = 'item=3D1=E2=80=99) for the open path. 
If = not, what is the reason to have two items and what does each stand = for?

Thanks = again for your help in advance.

/Kangkook


On Jan 14, 2015, at 9:30 AM, = Richard Guy Briggs <rgb@redhat.com> wrote:

On 15/01/14, Kangkook Jee wrote:
Hi, all

Hi Kangkook,

I have a question = regarding how to interpret the audit message that we got for
an open system call. In most cases, we observe a single item = (path) information
followed by 'syscall' and 'cwd' = messages. However, in some cases, we see 2 or 3
items = (paths) followed by 'syscall' and 'cwd' messages like following = cases.

CASE 1:

Jan 14 11:00:01 hostname kernel: [4980285.399982] type=3D1300 = audit(1421233201.056:893730395): arch=3Dc000003e syscall=3D2 success=3Dyes= exit=3D5 a0=3D7ffff4ae5830 a1=3Dc2 a2=3D180 a3=3D2233546f14d99 items=3D2 = ppid=3D983 pid=3D5723 auid=3D4294967295 uid=3D0 gid=3D0 euid=3D0 suid=3D0 = fsuid=3D0 egid=3D0 sgid=3D0 fsgid=3D0 ses=3D4294967295 tty=3D(none) = comm=3D"cron" exe=3D"/usr/sbin/cron" key=3D(null)
Jan 14 = 11:00:01 hostname kernel: [4980285.399985] type=3D1307 = audit(1421233201.056:893730395):  cwd=3D"/var/spool/cron"
Jan 14 11:00:01 hostname kernel: [4980285.399988] type=3D1302 = audit(1421233201.056:893730395): item=3D0 name=3D"/tmp/" inode=3D40961 = dev=3Dca:01 mode=3D041777 ouid=3D0 ogid=3D0 rdev=3D00:00
Jan= 14 11:00:01 hostname kernel: [4980285.399990] type=3D1302 = audit(1421233201.056:893730395): item=3D1 name=3D"/tmp/tmpfS9woiP" = inode=3D30733 dev=3Dca:01 mode=3D0100600 ouid=3D0 ogid=3D0 rdev=3D00:00
CASE 2:

Jan 14 = 11:19:37 hostname kernel: [4981461.529450] type=3D1300 = audit(1421234377.184:894228556): arch=3Dc000003e syscall=3D2 success=3Dyes= exit=3D5 a0=3Dfa9700 a1=3D441 a2=3D1b6 a3=3D0 items=3D3 ppid=3D5727 = pid=3D5728 auid=3D4294967295 uid=3D1000 gid=3D1000 euid=3D1000 suid=3D1000= fsuid=3D1000 egid=3D1000 sgid=3D1000 fsgid=3D1000 ses=3D4294967295 = tty=3D(none) comm=3D"Run" exe=3D"/usr/bin/perl" key=3D(null)
Jan 14 11:19:37 hostname kernel: [4981461.529454] type=3D1307 = audit(1421234377.184:894228556): =  cwd=3D"/home/ubuntu/benchmarks/UnixBench/testdir"
Jan = 14 11:19:37 hostname kernel: [4981461.529458] type=3D1302 = audit(1421234377.184:894228556): item=3D0 = name=3D"/home/ubuntu/benchmarks/UnixBench/results/" inode=3D396144 = dev=3Dca:01 mode=3D040775 ouid=3D1000 ogid=3D1000 rdev=3D00:00
Jan 14 11:19:37 hostname kernel: [4981461.529460] type=3D1302 = audit(1421234377.184:894228556): item=3D1 name=3D(null) inode=3D440344 = dev=3Dca:01 mode=3D0100664 ouid=3D1000 ogid=3D1000 rdev=3D00:00
Jan 14 11:19:37 hostname kernel: [4981461.529463] type=3D1302 = audit(1421234377.184:894228556): item=3D2 name=3D(null) inode=3D440344 = dev=3Dca:01 mode=3D0100664 ouid=3D1000 ogid=3D1000 rdev=3D00:00

I investigated audit source code a bit and = found out that these are produced as
a result of = enumerations over audit_context.names_list data structure. But, I'm
still not clear how and when entries for this data structure = are filled.

There has been active work done recently to fix = this problem.  Your case
#2 is clearly an example = of what we've been seeing.

Paul Moore sent a patch in = early December and another at the end of
December, followed by a patchset from January = 8th in an attempt to clean
things up for = good:
https://www.redhat.com/archives/linux-audit/2014-December/msg00= 001.html
= audit: correctly record = file names with different path name types
https://www.redhat.com/archives/linux-audit/2014-December/msg00= 108.html
= audit: create private file = name copies when auditing inodes
https://www.redhat.com/archives/linux-audit/2015-January/msg000= 16.html
= "Overhaul the audit = filename handling"

See also:
= https://bugzilla.redhat.com/show_bug.cgi?id=3D1155208

Could anyone explain = what would it mean to have multiple items (paths) means for
a single open syscall invocation?

Usually directory and = file.

Thanks a lot for your help in advance. 

Regards, Kangkook

- RGB

--
Richard Guy Briggs <rbriggs@redhat.com>
Senior Software Engineer, = Kernel Security, AMER ENG Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635, = Alt: +1.613.693.0684x3545

= --Apple-Mail=_50B078FD-FF20-45F3-8757-B3CDCDC47597-- --===============0846394768021956728== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============0846394768021956728==--