From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Hassan Sultan" Subject: Re: ABI guarantee for auditd Date: Thu, 15 Jan 2015 20:45:44 -0800 Message-ID: References: <3fbf5caa9cacbccadda7623eabadbc05@thefroid.net> <9201597.kpTtueEqur@x2> <3567295.SZ2jdmf0NG@x2> <67f972dd606a13a87560d389463a5390@thefroid.net> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; Format="flowed"; DelSp="yes" Content-Transfer-Encoding: 7bit Return-path: Received: from mx1.redhat.com (ext-mx11.extmail.prod.ext.phx2.redhat.com [10.5.110.16]) by int-mx11.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id t0G4imDJ031210 for ; Thu, 15 Jan 2015 23:44:48 -0500 Received: from homiemail-a91.g.dreamhost.com (sub5.mail.dreamhost.com [208.113.200.129]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id t0G4ilnG015460 for ; Thu, 15 Jan 2015 23:44:47 -0500 In-Reply-To: <67f972dd606a13a87560d389463a5390@thefroid.net> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com, hsultan@thefroid.net List-Id: linux-audit@redhat.com On Thu, 15 Jan 2015 18:20:41 -0800, wrote: > On 2015-01-15 14:59, Steve Grubb wrote: >> On Thursday, January 15, 2015 02:34:16 PM hsultan@thefroid.net wrote: >>> On 2015-01-15 12:44, Steve Grubb wrote: >>> > On Thursday, January 15, 2015 12:24:38 PM hsultan@thefroid.net wrote: >>> >> Regarding auditd, what is the ABI guarantee ? Do you guarantee that >>> >> the >>> >> text contained in audit_reply->msg.data will always be the same >>> >> format ? >>> >> I imagine you reserve the right to add fields, but how about >>> >> removing >>> >> any or even reordering them ? >>> > >>> > Its happens on occasion. Requirements change, bugs are found, new >>> > features asked for. >>> >>> Thanks, that tells me most of what I need, one last thing : do you >>> happen to know if the 'big' distribs(Ubuntu,RH,CentOS,Debian...) ship >>> those format changes only in new releases of their distribs, or do they >>> include them in patches for existing releases as well ? >> >> I can't speak for other distributions, but if I find a mistake in the >> audit >> records, I fix it to be right rather than hold ABI and stay forever >> wrong. This >> doesn't happen very often. The audit records are mostly stable. But >> there are >> 155 different records. > > Thanks for the info, so I tried using libauparse (again, Ubuntu 14.04 > LTS), however I'm hitting something truly weird: once I've adddd the > event parsing code (taken from > https://fedorahosted.org/audit/browser/trunk/contrib/plugin/audisp-example.c > ) and added -lauparse, what I get out of audit_get_reply now is mangled. > That clearly can't be a code mistake because I didn't touch the event > retrieval code, it's totally separate and runs in a separate thread, > dropping the messages retrieved in a queue that the parser picks from. > Weird thing is, even if I comment out the parsing code, the problem > remains. Then I even remove the libauparse lib from the link settings > and rebuild from scratch, problem remains. BUT then I reboot the box, > and the SAME PROCESS (no recompiling, just a reboot) now shows events > properly again. > > Is there a conflict or some specific setup between the 2 libraries I > should know about ? Does libauparse configures the audit infrastructure > in the kernel somehow ? > > My libauparse version is 1:2.3.2-2ubuntu1 and from dpkg-query it lists : > > Breaks: libaudit0, libaudit1 (<< 1:2.2.1-2) > > My libaudit is : > Version: 1:2.3.2-2ubuntu1 Ok ignore my message, I'm truly an idiot and should pay more attention before I send questions here. Sorry, Hassan