From mboxrd@z Thu Jan 1 00:00:00 1970 From: hsultan@thefroid.net Subject: Re: ABI guarantee for auditd Date: Thu, 15 Jan 2015 18:20:41 -0800 Message-ID: <67f972dd606a13a87560d389463a5390@thefroid.net> References: <3fbf5caa9cacbccadda7623eabadbc05@thefroid.net> <9201597.kpTtueEqur@x2> <3567295.SZ2jdmf0NG@x2> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; Format="flowed" Content-Transfer-Encoding: 7bit Return-path: Received: from mx1.redhat.com (ext-mx11.extmail.prod.ext.phx2.redhat.com [10.5.110.16]) by int-mx11.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id t0G2Khp7009486 for ; Thu, 15 Jan 2015 21:20:43 -0500 Received: from homiemail-a59.g.dreamhost.com (sub5.mail.dreamhost.com [208.113.200.129]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id t0G2Kgmc014379 for ; Thu, 15 Jan 2015 21:20:42 -0500 Received: from homiemail-a59.g.dreamhost.com (localhost [127.0.0.1]) by homiemail-a59.g.dreamhost.com (Postfix) with ESMTP id CF81F56405C for ; Thu, 15 Jan 2015 18:20:41 -0800 (PST) Received: from webmail.thefroid.net (caiajhbihbdd.dreamhost.com [208.97.187.133]) (Authenticated sender: hsultan@thefroid.net) by homiemail-a59.g.dreamhost.com (Postfix) with ESMTPA id C31AC564057 for ; Thu, 15 Jan 2015 18:20:41 -0800 (PST) In-Reply-To: <3567295.SZ2jdmf0NG@x2> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com On 2015-01-15 14:59, Steve Grubb wrote: > On Thursday, January 15, 2015 02:34:16 PM hsultan@thefroid.net wrote: >> On 2015-01-15 12:44, Steve Grubb wrote: >> > On Thursday, January 15, 2015 12:24:38 PM hsultan@thefroid.net >> wrote: >> >> Regarding auditd, what is the ABI guarantee ? Do you guarantee >> that >> >> the >> >> text contained in audit_reply->msg.data will always be the same >> >> format ? >> >> I imagine you reserve the right to add fields, but how about >> >> removing >> >> any or even reordering them ? >> > >> > Its happens on occasion. Requirements change, bugs are found, new >> > features asked for. >> >> Thanks, that tells me most of what I need, one last thing : do you >> happen to know if the 'big' distribs(Ubuntu,RH,CentOS,Debian...) >> ship >> those format changes only in new releases of their distribs, or do >> they >> include them in patches for existing releases as well ? > > I can't speak for other distributions, but if I find a mistake in the > audit > records, I fix it to be right rather than hold ABI and stay forever > wrong. This > doesn't happen very often. The audit records are mostly stable. But > there are > 155 different records. Thanks for the info, so I tried using libauparse (again, Ubuntu 14.04 LTS), however I'm hitting something truly weird: once I've adddd the event parsing code (taken from https://fedorahosted.org/audit/browser/trunk/contrib/plugin/audisp-example.c ) and added -lauparse, what I get out of audit_get_reply now is mangled. That clearly can't be a code mistake because I didn't touch the event retrieval code, it's totally separate and runs in a separate thread, dropping the messages retrieved in a queue that the parser picks from. Weird thing is, even if I comment out the parsing code, the problem remains. Then I even remove the libauparse lib from the link settings and rebuild from scratch, problem remains. BUT then I reboot the box, and the SAME PROCESS (no recompiling, just a reboot) now shows events properly again. Is there a conflict or some specific setup between the 2 libraries I should know about ? Does libauparse configures the audit infrastructure in the kernel somehow ? My libauparse version is 1:2.3.2-2ubuntu1 and from dpkg-query it lists : Breaks: libaudit0, libaudit1 (<< 1:2.2.1-2) My libaudit is : Version: 1:2.3.2-2ubuntu1 Thanks, Hassan